CVE-2012-0874

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-0874
The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://archives.neohapsis.com/archives/bugtraq/2013-12/0134.html
http://rhn.redhat.com/errata/RHSA-2013-0191.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0192.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0193.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0194.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0195.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0196.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0197.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0198.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0221.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0533.html
http://secunia.com/advisories/51984 Vendor Advisory
http://secunia.com/advisories/52054 Vendor Advisory
http://securitytracker.com/id?1028042
http://www.exploit-db.com/exploits/30211
http://www.securityfocus.com/bid/57552
https://bugzilla.redhat.com/show_bug.cgi?id=795645
https://exchange.xforce.ibmcloud.com/vulnerabilities/81511
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:*
History

07 Nov 2023, 02:10

Type Values Removed Values Added
Summary The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer. The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.

13 Feb 2023, 04:32

Type Values Removed Values Added
Summary The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer. The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.
Information

Published : 2013-02-05 23:55

Updated : 2023-12-10 11:16

NVD link : CVE-2012-0874

Mitre link : CVE-2012-0874

CVE.ORG link : CVE-2012-0874

JSON object : View

Products Affected

redhat

  • jboss_enterprise_brms_platform
  • jboss_enterprise_web_platform
  • jboss_enterprise_application_platform
CWE
CWE-287

Improper Authentication