LiveActive security incident?Get immediate response
CVE Record

CVE-2011-3606: A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 admin...

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2011-3606 is a DOM-based cross-site scripting issue in the JBoss Application Server 7 admin console before 7.1.0 Beta 1. An attacker would need to trick an authenticated administrator into visiting crafted content. The bundle does not provide CVSS, confirmed exploitation, or detailed remediation guidance.

Executive priority

Treat this as a legacy-platform hygiene issue with administrator-session risk. It should be prioritized if JBoss AS 7 admin consoles remain reachable, especially in environments where administrators browse externally from the same session. It is not documented here as actively exploited.

Technical view

The flaw affects the JBoss AS 7 administration console before 7.1.0 Beta 1. The described impact is DOM environment modification leading to arbitrary HTML or web script execution in a privileged user context. No CWE, CVSS vector, exploit maturity, or patch advisory details are included beyond the version boundary.

Likely exposure

Exposure is most likely in legacy JBoss Application Server 7 deployments with the administration console reachable to users and administrators browsing while authenticated. Modern or upgraded environments are less likely to be affected, but the sources do not enumerate distributions or package states.

Exploitation context

The provided sources describe a social-engineering path: a remote attacker crafts a web page and persuades a valid administrator to visit it. There is no KEV listing and no cited evidence of active exploitation in the supplied bundle.

Researcher notes

The bundle is sparse: no CVSS, CWE, exploit status, or detailed vendor fix text is included. The key confirmed facts are product, affected version range, DOM-based XSS class, admin-user interaction requirement, and arbitrary HTML or script execution impact.

Mitigation direction

  • Identify any JBoss Application Server 7 deployments still in service.
  • Confirm whether affected systems are before 7.1.0 Beta 1.
  • Restrict administration console access to trusted management networks.
  • Review Red Hat or vendor guidance before applying any remediation.
  • Reduce administrator exposure to untrusted web content while authenticated.

Validation and detection

  • Inventory application servers and record exact JBoss AS versions.
  • Check whether the administration console is enabled and reachable.
  • Review access controls around the admin console endpoint.
  • Look for compensating network restrictions on management interfaces.
  • Search internal tickets for historical upgrade or mitigation evidence.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2011-3606 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
JBoss Application ServerJBoss Application Server7 before 7.1.0 Beta 1Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.