CVE-2011-3609

CVE-2011-3609 describes a Cross-Site Request Forgery (CSRF) vulnerability in JBoss Application Server 7 prior to version 7.1.0. This flaw allows an attacker to leak sensitive management console information if an authenticated administrator visits a malicious webpage, due to improper access restrictions like the "Access-Control-Allow-Origin" header. Rated as MEDIUM severity with a CVSS score of 6.5, this vulnerability has a network attack vector and low attack complexity, requiring user interaction (UI:R). The primary impact is unauthorized information disclosure (C:H), with no integrity or availability impact. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has garnered minimal community discussion and media coverage, indicating a low level of public attention.