widely-deployed-product-advisoryprivilege-escalation-methodinternet-facing-service-vulnerabilityopen-source-dependency-vulnerability

Red Hat JBoss EAP 7 Updates Fix RBAC Escalation, Undertow Header Injection, and XXE

Patch & Detection Intelligence · 8 sources · Updated 2mo ago · First seen Sep 8, 2016

Red Hat released JBoss Enterprise Application Platform (EAP) 7.0.2 updates for RHEL 6, RHEL 7, and the eap7-jboss-ec2-eap package to remediate three security flaws: CVE-2016-5406, a domain-management RBAC propagation failure that can grant full administrative privileges on EAP 6.2–6.4 slave hosts; CVE-2016-4993, Undertow HTTP header injection and response splitting through unsanitized header input; and CVE-2015-0254, an XXE flaw in JSTL that can expose host resources and may enable arbitrary code execution.

The fixes were delivered in RHSA-2016:1838 for RHEL 6, RHSA-2016:1839 for RHEL 7, and RHSA-2016:1840 for EAP EC2 deployments. Affected organizations should back up EAP installations and deployed applications, apply the appropriate EAP 7.0.2 packages, and restart JBoss server processes to activate the remediations.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Aug 31, 2015 – Sep 8, 2016

Reported Sep 8, 201610y ago
Red Hat issues follow-up JBoss EAP 7 erratum
Red Hat issued RHSA-2017:3456 as a subsequent JBoss EAP 7 erratum fixing CVE-2016-4993 and CVE-2016-5406.
1359014 - (CVE-2016-5406) CVE-2016-5406 EAP7 Privilege escalation when managing domain including earlier version slaves
Sep 8, 201610y ago
Red Hat releases RHSA-2016:1841 for JBoss EAP 7
Red Hat released RHSA-2016:1841 to fix CVE-2016-4993 and CVE-2016-5406 in JBoss EAP 7 products.
1359014 - (CVE-2016-5406) CVE-2016-5406 EAP7 Privilege escalation when managing domain including earlier version slaves
Sep 8, 201610y ago
Red Hat updates EAP EC2 package for CVE-2016-4993 and CVE-2016-5406
Red Hat released RHSA-2016:1840 for the eap7-jboss-ec2-eap package on RHEL 6 and RHEL 7, making it compatible with EAP 7.0.2. The Important update addressed CVE-2016-4993 and CVE-2016-5406, as well as CVE-2015-0254.
RHSA-2016:1840 - Security Advisory - Red Hat Customer Portal
Sep 8, 201610y ago
Red Hat releases EAP 7.0.2 update for RHEL 7
Red Hat published RHSA-2016:1839, an Important advisory delivering JBoss EAP 7.0.2 packages for RHEL 7. It fixed the Undertow header-injection issue CVE-2016-4993 and the EAP domain-management RBAC privilege-escalation issue CVE-2016-5406.
RHSA-2016:1839 - Security Advisory - Red Hat Customer Portal
Sep 8, 201610y ago
Red Hat releases EAP 7.0.2 update for RHEL 6
Red Hat issued RHSA-2016:1838, an Important advisory providing JBoss EAP 7.0.2 for RHEL 6. The update remediated CVE-2016-4993 HTTP header injection/response splitting and CVE-2016-5406 privilege escalation, alongside CVE-2015-0254.
CVE-2016-4993 - Red Hat Customer Portal
Reported Aug 31, 201511y ago
Red Hat fixes JSTL flaw in JBoss EAP 6.4.z
Red Hat issued RHSA-2016:0121, RHSA-2016:0122, RHSA-2016:0123, and RHSA-2016:0124 to remediate CVE-2015-0254 in JBoss EAP 6.4.z on RHEL 5, RHEL 6, and RHEL 7. Red Hat advised users to upgrade to at least EAP 6.4.9 and set org.apache.taglibs.standard.xml.accessExternalEntity=false to prevent JSTL XXE attacks.
1198606 - (CVE-2015-0254) CVE-2015-0254 jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags
Aug 31, 201511y ago
Red Hat fixes JSTL XXE flaw in RHEL 6 and 7
Red Hat issued RHSA-2015:1695 for Red Hat Enterprise Linux 6 and 7 packages containing jakarta-taglibs-standard, fixing CVE-2015-0254. The Important JSTL XML external-entity vulnerability could allow access to host resources and potentially arbitrary code execution through XSL extensions.
CVE-2015-0254 - Red Hat Customer Portal

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

3 linked

HTTP Header Injection and Response Splitting in Undertow (CVE-2016-4993)JBoss EAP Domain Controller RBAC Propagation Privilege Escalation (CVE-2016-5406)XXE and XSLT Extension RCE in Apache Standard Taglibs (CVE-2015-0254)

Affected products

2 linked

UndertowJboss Enterprise Application Platform

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

8 references tracked. Mallory keeps watching after this page renders.

Rhn RedhatNews · Jan 1, 2026

RHSA-2016:1839 - Security Advisory - Red Hat Customer PortalOpen source ↗

Rhn RedhatNews · Jan 1, 2026

RHSA-2016:1838 - Security Advisory - Red Hat Customer PortalOpen source ↗

Rhn RedhatNews · Jan 1, 2026

RHSA-2016:1840 - Security Advisory - Red Hat Customer PortalOpen source ↗

Bugzilla RedhatNews · Sep 8, 2016

1359014 - (CVE-2016-5406) CVE-2016-5406 EAP7 Privilege escalation when managing domain including earlier version slavesOpen source ↗

Redhat OtherNews · Sep 8, 2016

CVE-2016-4993 - Red Hat Customer PortalOpen source ↗

Redhat OtherNews · Sep 8, 2016

CVE-2016-5406 - Red Hat Customer PortalOpen source ↗

Bugzilla RedhatNews · Aug 31, 2015

1198606 - (CVE-2015-0254) CVE-2015-0254 jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tagsOpen source ↗

Redhat OtherNews · Aug 31, 2015

CVE-2015-0254 - Red Hat Customer PortalOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

widely-deployed-product-advisoryprivilege-escalation-methodinternet-facing-service-vulnerabilityopen-source-dependency-vulnerability

Red Hat JBoss EAP 7 Updates Fix RBAC Escalation, Undertow Header Injection, and XXE

Patch & Detection Intelligence · 8 sources · Updated 2mo ago · First seen Sep 8, 2016

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Aug 31, 2015 – Sep 8, 2016

Reported Sep 8, 201610y ago
Red Hat issues follow-up JBoss EAP 7 erratum
Red Hat issued RHSA-2017:3456 as a subsequent JBoss EAP 7 erratum fixing CVE-2016-4993 and CVE-2016-5406.
1359014 - (CVE-2016-5406) CVE-2016-5406 EAP7 Privilege escalation when managing domain including earlier version slaves
Sep 8, 201610y ago
Red Hat releases RHSA-2016:1841 for JBoss EAP 7
Red Hat released RHSA-2016:1841 to fix CVE-2016-4993 and CVE-2016-5406 in JBoss EAP 7 products.
1359014 - (CVE-2016-5406) CVE-2016-5406 EAP7 Privilege escalation when managing domain including earlier version slaves
Sep 8, 201610y ago
Red Hat updates EAP EC2 package for CVE-2016-4993 and CVE-2016-5406
Red Hat released RHSA-2016:1840 for the eap7-jboss-ec2-eap package on RHEL 6 and RHEL 7, making it compatible with EAP 7.0.2. The Important update addressed CVE-2016-4993 and CVE-2016-5406, as well as CVE-2015-0254.
RHSA-2016:1840 - Security Advisory - Red Hat Customer Portal
Sep 8, 201610y ago
Red Hat releases EAP 7.0.2 update for RHEL 7
Red Hat published RHSA-2016:1839, an Important advisory delivering JBoss EAP 7.0.2 packages for RHEL 7. It fixed the Undertow header-injection issue CVE-2016-4993 and the EAP domain-management RBAC privilege-escalation issue CVE-2016-5406.
RHSA-2016:1839 - Security Advisory - Red Hat Customer Portal
Sep 8, 201610y ago
Red Hat releases EAP 7.0.2 update for RHEL 6
Red Hat issued RHSA-2016:1838, an Important advisory providing JBoss EAP 7.0.2 for RHEL 6. The update remediated CVE-2016-4993 HTTP header injection/response splitting and CVE-2016-5406 privilege escalation, alongside CVE-2015-0254.
CVE-2016-4993 - Red Hat Customer Portal
Reported Aug 31, 201511y ago
Red Hat fixes JSTL flaw in JBoss EAP 6.4.z
Red Hat issued RHSA-2016:0121, RHSA-2016:0122, RHSA-2016:0123, and RHSA-2016:0124 to remediate CVE-2015-0254 in JBoss EAP 6.4.z on RHEL 5, RHEL 6, and RHEL 7. Red Hat advised users to upgrade to at least EAP 6.4.9 and set org.apache.taglibs.standard.xml.accessExternalEntity=false to prevent JSTL XXE attacks.
1198606 - (CVE-2015-0254) CVE-2015-0254 jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags
Aug 31, 201511y ago
Red Hat fixes JSTL XXE flaw in RHEL 6 and 7
Red Hat issued RHSA-2015:1695 for Red Hat Enterprise Linux 6 and 7 packages containing jakarta-taglibs-standard, fixing CVE-2015-0254. The Important JSTL XML external-entity vulnerability could allow access to host resources and potentially arbitrary code execution through XSL extensions.
CVE-2015-0254 - Red Hat Customer Portal

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

3 linked

Affected products

2 linked

UndertowJboss Enterprise Application Platform

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

8 references tracked. Mallory keeps watching after this page renders.

Rhn RedhatNews · Jan 1, 2026

RHSA-2016:1839 - Security Advisory - Red Hat Customer PortalOpen source ↗

Rhn RedhatNews · Jan 1, 2026

RHSA-2016:1838 - Security Advisory - Red Hat Customer PortalOpen source ↗

Rhn RedhatNews · Jan 1, 2026

RHSA-2016:1840 - Security Advisory - Red Hat Customer PortalOpen source ↗

Bugzilla RedhatNews · Sep 8, 2016

1359014 - (CVE-2016-5406) CVE-2016-5406 EAP7 Privilege escalation when managing domain including earlier version slavesOpen source ↗

Redhat OtherNews · Sep 8, 2016

CVE-2016-4993 - Red Hat Customer PortalOpen source ↗

Redhat OtherNews · Sep 8, 2016

CVE-2016-5406 - Red Hat Customer PortalOpen source ↗

Bugzilla RedhatNews · Aug 31, 2015

1198606 - (CVE-2015-0254) CVE-2015-0254 jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tagsOpen source ↗

Redhat OtherNews · Aug 31, 2015

CVE-2015-0254 - Red Hat Customer PortalOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Red Hat JBoss EAP 7 Updates Fix RBAC Escalation, Undertow Header Injection, and XXE

How this story unfolded

Red Hat issues follow-up JBoss EAP 7 erratum

Red Hat releases RHSA-2016:1841 for JBoss EAP 7

Red Hat updates EAP EC2 package for CVE-2016-4993 and CVE-2016-5406

Red Hat releases EAP 7.0.2 update for RHEL 7

Red Hat releases EAP 7.0.2 update for RHEL 6

Red Hat fixes JSTL flaw in JBoss EAP 6.4.z

Red Hat fixes JSTL XXE flaw in RHEL 6 and 7

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Red Hat JBoss EAP Updates Fix XXE, RBAC Bypass, and Information Disclosure

Red Hat JBoss EAP 6.4 Update Fixes Request Smuggling, DoS and RBAC Data Exposure

Red Hat JBoss EAP 6.4.14 Fixes Local Root Escalation and DoS Flaws

Red Hat JBoss EAP 7 Updates Fix RBAC Escalation, Undertow Header Injection, and XXE

How this story unfolded

Red Hat issues follow-up JBoss EAP 7 erratum

Red Hat releases RHSA-2016:1841 for JBoss EAP 7

Red Hat updates EAP EC2 package for CVE-2016-4993 and CVE-2016-5406

Red Hat releases EAP 7.0.2 update for RHEL 7

Red Hat releases EAP 7.0.2 update for RHEL 6

Red Hat fixes JSTL flaw in JBoss EAP 6.4.z

Red Hat fixes JSTL XXE flaw in RHEL 6 and 7

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Red Hat JBoss EAP Updates Fix XXE, RBAC Bypass, and Information Disclosure

Red Hat JBoss EAP 6.4 Update Fixes Request Smuggling, DoS and RBAC Data Exposure

Red Hat JBoss EAP 6.4.14 Fixes Local Root Escalation and DoS Flaws