Red Hat JBoss Web Server 6.2.0 is a security release that fixes three identified vulnerabilities in Apache Tomcat components bundled with the server. CVE-2025-46701 addresses a security constraint bypass for CGI scripts, CVE-2025-55668 fixes a session fixation vulnerability via the rewrite valve, and CVE-2025-55754 mitigates console manipulation issues. These vulnerabilities affect versions >=6.1.3 and <6.2.0. The release serves as a replacement for 6.1.3 and includes additional bug fixes and enhancements. No CVSS scores are provided in the advisory, but Red Hat rates the impact as moderate. The vendor advisory confirms the availability of this official fix.

The vulnerabilities fixed in this release could allow attackers to bypass security constraints on CGI scripts, perform session fixation attacks, or manipulate the console, potentially leading to unauthorized access or control over web applications hosted on the affected server versions. The overall security impact is rated moderate by Red Hat, indicating a significant but not critical risk to affected systems.

An official fix is available in Red Hat JBoss Web Server version 6.2.0, which replaces version 6.1.3. Users should back up their existing installations, including applications and configuration files, before applying the update. Applying this update mitigates the identified vulnerabilities. No additional mitigation steps are specified or required beyond updating to the fixed version.