PT-2012-3103

CVE-2012-1154

Published

2012-10-22

Updated

2022-05-17

Description by

CVSS 2.0

4.3

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions mod cluster versions 1.0.10 through 1.0.10 CP02 mod cluster versions 1.1.x through 1.1.3

Description The issue allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors when the "ROOT" is set to excludedContexts.

Recommendations For mod cluster versions 1.0.10 through 1.0.10 CP02, update to version 1.0.10 CP03 or later. For mod cluster versions 1.1.x through 1.1.3, update to version 1.1.4 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-264

CWE-284: Improper Access Control

Related identifiers

CVE-2012-1154

GHSA-V2FP-H4QX-X3R6