CVEvulnerability
CVE-2012-1167
4.6 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-11-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:N/AC:H/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.
Affected configurations
• redhat jboss enterprise application platform 5.1.0
• redhat jboss enterprise application platform 5.1.1
• redhat jboss enterprise application platform 5.2.0
• redhat jboss enterprise application platform 5.2.1
• redhat jboss enterprise brms platform (<= 5.2.0)
• redhat jboss enterprise soa platform (<= 5.2.0)
• redhat jboss enterprise soa platform 5.0.0
• redhat jboss enterprise soa platform 5.0.1
• redhat jboss enterprise soa platform 5.0.2
• redhat jboss enterprise soa platform 5.1.0
• redhat jboss enterprise soa platform 5.1.1
• redhat jboss enterprise web platform (<= 5.1.1)
• redhat jboss enterprise web platform 5.1.0
Related
Weakness · not in database (1)
References
- http://rhn.redhat.com/errata/RHSA-2012-1013.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1014.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1026.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1027.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1028.html rhn.redhat.com
- http://rhn.redhat.com/errata/RHSA-2012-1125.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1232.html Vendor Advisory
- http://secunia.com/advisories/49635 Vendor Advisory
- http://secunia.com/advisories/49658 Vendor Advisory
- http://secunia.com/advisories/50549 Vendor Advisory
- http://securitytracker.com/id?1027501 securitytracker.com
- http://www.securityfocus.com/bid/54089 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=802622 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76680 exchange.xforce.ibmcloud.com
- http://rhn.redhat.com/errata/RHSA-2012-1013.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1014.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1026.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1027.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1028.html rhn.redhat.com
- http://rhn.redhat.com/errata/RHSA-2012-1125.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1232.html Vendor Advisory
- http://secunia.com/advisories/49635 Vendor Advisory
- http://secunia.com/advisories/49658 Vendor Advisory
- http://secunia.com/advisories/50549 Vendor Advisory
- http://securitytracker.com/id?1027501 securitytracker.com
- http://www.securityfocus.com/bid/54089 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=802622 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76680 exchange.xforce.ibmcloud.com