Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2012-3369

Overview

Vulnerability Score 4.0 4.0
CVE Id CVE-2012-3369
Last Modified 17 Jan 2015 09:59:10
Published 05 Feb 2013 06:55:01
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity HIGH
Authentication NONE

CVE-2012-3369

Summary

The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's password to be used.

Vulnerable Systems

Application

  • Redhat Jboss Enterprise Application Platform 5.2.0

  • Redhat Jboss Enterprise Brms Platform 5.3.0

  • Redhat Jboss Enterprise Web Platform 5.2.0


References

MISC - https://bugzilla.redhat.com/show_bug.cgi?id=836451

XF - jboss-eap-session-hijacking(81512)

BID - 57547

SECTRACK - 1028042

SECUNIA - 52054

SECUNIA - 51984

REDHAT - RHSA-2013:0221

REDHAT - RHSA-2013:0198

REDHAT - RHSA-2013:0197

REDHAT - RHSA-2013:0196

REDHAT - RHSA-2013:0195

REDHAT - RHSA-2013:0194

REDHAT - RHSA-2013:0193

REDHAT - RHSA-2013:0192

REDHAT - RHSA-2013:0191

REDHAT - RHSA-2013:0533


Last Updated: 27 May 2016 11:01:48