jboss-fuse/fuse

jboss-fuse/fuse

Releases643

Frequency5 days 6 hours

Last Releaseover 2 years ago

Stars142

JBoss Fuse is an open source ESB with capabilities based on Apache Camel, Apache CXF, Apache ActiveMQ, Apache Karaf and Fabric8 in a single integrated distribution.

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2018-10906NVD↗	>= 3.0, < 3.2.5, < 2.9.8	Jul 24, 2018Tuesday, 24 July 2018, 20:29	—	4.6 MEDIUM
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.
CVE-2015-3202NVD↗	<= 2.9.2	Jul 2, 2015Thursday, 2 July 2015, 21:59	—	3.6 LOW
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
CVE-2013-4372NVD↗	—	Sep 30, 2013Monday, 30 September 2013, 21:55	—	4.3 MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.