CVEvulnerability

CVE-2011-4605

7.5 HIGH Published 2012-11-23 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-11-23
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-264

Description

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

Affected configurations

• redhat jboss enterprise application platform 4.3.0 • redhat jboss enterprise application platform 5.1.2 • redhat jboss enterprise brms platform (<= 5.2.0) • redhat jboss enterprise portal platform 4.3.0 • redhat jboss enterprise portal platform 5.2.0 • redhat jboss enterprise portal platform 5.2.1 • redhat jboss enterprise soa platform 4.2.0 • redhat jboss enterprise soa platform 4.3.0 • redhat jboss enterprise web platform 5.1.2

Related

Weakness · not in database (1)

References