Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2012-3370

Overview
Vulnerability Score	5.8
CVE Id	CVE-2012-3370
Last Modified	17 Jan 2015 09:59:11
Published	05 Feb 2013 06:55:01
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	NONE
Access Vector	NETWORK
Access Complexity	MEDIUM
Authentication	NONE

CVE-2012-3370

Summary

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remote attackers to gain privileges as other users.