PT-2013-1603

CVE-2012-3370

Publicado

2013-02-05

Atualizado

2017-08-29

Descrição por

CVSS 2.0

5.8

Média

MétricasAV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform (EAP) versions prior to 5.2.0 JBoss Web Platform (EWP) versions prior to 5.2.0 BRMS Platform versions prior to 5.3.1 SOA Platform versions prior to 5.3.1

Description The issue allows remote attackers to gain privileges as other users due to the SecurityAssociation.getCredential method returning the credentials of the previous user when a security context is not provided.

Recommendations For JBoss Enterprise Application Platform (EAP) versions prior to 5.2.0, update to version 5.2.0 or later. For JBoss Web Platform (EWP) versions prior to 5.2.0, update to version 5.2.0 or later. For BRMS Platform versions prior to 5.3.1, update to version 5.3.1 or later. For SOA Platform versions prior to 5.3.1, update to version 5.3.1 or later.

Explorabilidade

Correção

Pesquisadores

Carlo De Wolf

David Jorm

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-264

Identificadores relacionados

CVE-2012-3370

RHSA-2013:0191