CVE-2015-5188

Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.

• CWE-352

• http://rhn.redhat.com/errata/RHSA-2015-1904.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1905.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1906.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1907.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1908.htmlVendor Advisory
• http://www.securitytracker.com/id/1033859
• https://bugzilla.redhat.com/show_bug.cgi?id=1252885Vendor Advisory
• https://issues.jboss.org/browse/WFCORE-594Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1904.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1905.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1906.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1907.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1908.htmlVendor Advisory
• http://www.securitytracker.com/id/1033859
• https://bugzilla.redhat.com/show_bug.cgi?id=1252885Vendor Advisory
• https://issues.jboss.org/browse/WFCORE-594Vendor Advisory

Published

Oct 27, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5182Cross-site request forgery (CSRF) vulnerability in the jolok…8.8
• CVE-2015-5183Console: HTTPOnly and Secure attributes not set on cookies i…7.5
• CVE-2015-5184Console: CORS headers set to allow all in Red Hat AMQ.7.5
• CVE-2015-5185The lookupProviders function in providerMgr.c in sblim-sfcb …
• CVE-2015-5186Audit before 2.4.4 in Linux does not sanitize escape charact…
• CVE-2015-5187Candlepin allows remote attackers to obtain sensitive inform…
• CVE-2015-5189Race condition in pcsd in PCS 0.9.139 and earlier uses a glo…
• CVE-2015-5190The pcsd web UI in PCS 0.9.139 and earlier allows remote aut…
• CVE-2015-5191VMware Tools prior to 10.0.9 contains multiple file system r…
• CVE-2015-5192Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-5193Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-5194The log_config_command function in ntp_parser.y in ntpd in N…