GitHub Advisoryadvisory · Maven

GHSA-wq8g-hm94-5rqq JBoss AS may expose root content if excluded-contexts list is mismatched

HIGH Published 2022-04-23 Modified 2022-11-22 Official page ↗
Aliases
CVE-2012-1094
Ecosystem
Maven
Packages
org.jboss.as:jboss-as-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-11-22

Affected packages

• Maven org.jboss.as:jboss-as-server: >= 7.0.0.Alpha1, < 7.1.1.Final → fixed in 7.1.1.Final

Description

JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.

Related

Alias · CVE (1)

  • CVE-2012-1094 JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References