NVD

Id
42939  
Name
CVE-2012-0874  
Description
The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2013-02-05  
Modified Date
2015-01-17  
Seq
2012-0874  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
216164 42939 CVE-2012-0874 20131219 ESA-2013-094: EMC Data Protection Advisor JBOSS Remote Code Execution Vulnerability  View
216165 42939 CVE-2012-0874 RHSA-2013:0191  View
216166 42939 CVE-2012-0874 RHSA-2013:0192  View
216167 42939 CVE-2012-0874 RHSA-2013:0193  View
216168 42939 CVE-2012-0874 RHSA-2013:0194  View
216169 42939 CVE-2012-0874 RHSA-2013:0195  View
216170 42939 CVE-2012-0874 RHSA-2013:0196  View
216171 42939 CVE-2012-0874 RHSA-2013:0197  View
216172 42939 CVE-2012-0874 RHSA-2013:0198  View
216173 42939 CVE-2012-0874 RHSA-2013:0221  View
216174 42939 CVE-2012-0874 RHSA-2013:0533  View
216175 42939 CVE-2012-0874 1028042  View
216176 42939 CVE-2012-0874 30211  View
216177 42939 CVE-2012-0874 57552  View
216178 42939 CVE-2012-0874 jboss-eap-jmxinvokerhaservlet-code-exec(81511)  View
216179 42939 CVE-2012-0874 https://bugzilla.redhat.com/show_bug.cgi?id=795645  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19850 JVNDB-2013-001425 複数の JBoss Enterprise 製品における MBean メソッドを呼び出される脆弱性 複数の JBoss Enterprise 製品の (1) JMXInvokerHAServlet、および (2) EJBInvokerHAServlet の 呼び出し元のサーブレットは、特定プロファイルのデフォルトでは認証を必要としないため、MBean メソッドを呼び出され、任意のコードを実行される脆弱性が存在します。 CVE-2012-0874 54112 CVE-2012-0874 42939 6.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001425.html 2013-01-24 2013-02-07 View