GitHub Advisoryadvisory · Maven

GHSA-v2fp-h4qx-x3r6 Improper Access Control in JBoss mod_cluster

MEDIUM Published 2022-05-17 Modified 2022-11-01 Official page ↗
Aliases
CVE-2012-1154
Ecosystem
Maven
Packages
org.jboss.mod_cluster:mod_cluster
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2022-11-01

Affected packages

• Maven org.jboss.mod_cluster:mod_cluster: >= 1.1.0, < 1.1.4 → fixed in 1.1.4

Description

mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2012-1154 mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References