CVE-2012-0874

{"id": "CVE-2012-0874", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-02-05T23:55:01.380", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2013-12/0134.html", "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html", "source": "[email protected]"}, {"url": "http://secunia.com/advisories/51984", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://secunia.com/advisories/52054", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://securitytracker.com/id?1028042", "source": "[email protected]"}, {"url": "http://www.exploit-db.com/exploits/30211", "source": "[email protected]"}, {"url": "http://www.securityfocus.com/bid/57552", "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=795645", "source": "[email protected]"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81511", "source": "[email protected]"}, {"url": "http://archives.neohapsis.com/archives/bugtraq/2013-12/0134.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/51984", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/52054", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securitytracker.com/id?1028042", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.exploit-db.com/exploits/30211", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/57552", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=795645", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81511", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a \"second layer of authentication,\" or when used in conjunction with other vulnerabilities that bypass this second layer."}, {"lang": "es", "value": "Los servlets invocadores (1) JMXInvokerHAServlet y (2) EJBInvokerHAServlet en JBoss Enterprise Application Platform (EAP) anterior a versi\u00f3n 5.2.0, Plataforma Web (EWP) anterior a versi\u00f3n 5.2.0, BRMS Platform anterior a versi\u00f3n 5.3.1, y SOA Platform anterior a versi\u00f3n 5.3.1, no requieren autenticaci\u00f3n por defecto en ciertos perfiles, lo que podr\u00eda permitir a los atacantes remotos invocar m\u00e9todos MBean y ejecutar c\u00f3digo arbitrario por medio de vectores. NOTA: este problema solo puede ser explotado cuando el interceptor no est\u00e1 configurado apropiadamente con una \"second layer of authentication\", o cuando es usada junto con otras vulnerabilidades que omiten esta segunda capa."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46849C8D-36E9-4E97-BB49-E04F4EB199E6"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38F66D5B-F906-437E-977E-F9F930648886"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57FBD0FE-A84D-4707-A2DA-CB9F4920CBA8", "versionEndIncluding": "5.3.0"}], "operator": "OR"}]}], "evaluatorComment": "Per http://rhn.redhat.com/errata/RHSA-2013-0192.html \"This JBoss Enterprise Application Platform 5.2.0 release serves as a replacement for JBoss Enterprise Application Platform 5.1.2, and includes bug fixes and enhancements.\" Per http://rhn.redhat.com/errata/RHSA-2013-0196.html \"This JBoss Enterprise Web Platform 5.2.0 release serves as a replacement for JBoss Enterprise Web Platform 5.1.2, and includes bug fixes and enhancements.\"", "sourceIdentifier": "[email protected]"}