CVE-2012-1154 Improper Access Control in JBoss mod_cluster
MediumCVSS 4.3
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jboss.mod_cluster/mod_cluster(Maven) | >= 1.1.0, < 1.1.4 | 1.1.4 |
| org.jboss.mod_cluster/mod_cluster(Maven) | = 1.1.0.Final | No fix listed |
| org.jboss.mod_cluster/mod_cluster(Maven) | = 1.1.2.Final | No fix listed |
| org.jboss.mod_cluster/mod_cluster(Maven) | = 1.1.3.Final | No fix listed |
| redhat jboss enterprise application platform | = 5.1.2 | No fix listed |
| redhat mod cluster | = 1.0.10 | No fix listed |
| redhat mod cluster | = 1.1.0 | No fix listed |
| redhat mod cluster | = 1.1.1 | No fix listed |
| redhat mod cluster | = 1.1.2 | No fix listed |
| redhat mod cluster | = 1.1.3 | No fix listed |
| redhat mod cluster | = 1.1.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com
- community.jboss.org
- issues.jboss.org
- RHSA-2012:1010 vendor-advisory
- RHSA-2012:1011 vendor-advisory
- RHSA-2012:1012 vendor-advisory
- RHSA-2012:1052 vendor-advisory
- RHSA-2012:1053 vendor-advisory
- RHSA-2012:1166 vendor-advisory
- 49636 third-party-advisory vendor-advisory
- github.com