CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 0CVE-2012-3370 – JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided
https://notcve.org/view.php?id=CVE-2012-3370
05 Feb 2013 — The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remote attackers to gain privileges as other users. El método SecurityAssociation.getCredential en JBoss Enterprise Application Platform (EAP) anterior a versión 5.2.0, Web Platform (EWP) anterior a versión 5.2.0, BR... • http://rhn.redhat.com/errata/RHSA-2013-0191.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 57%CPEs: 3EXPL: 2CVE-2012-0874 – EMC Data Protection Advisor DPA Illuminator - EJBInvokerServlet Remote Code Execution
https://notcve.org/view.php?id=CVE-2012-0874
05 Feb 2013 — The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of aut... • https://www.exploit-db.com/exploits/30211 • CWE-287: Improper Authentication •
CVSS: 8.0EPSS: 0%CPEs: 8EXPL: 0CVE-2011-2908 – CSRF on jmx-console allows invocation of operations on mbeans
https://notcve.org/view.php?id=CVE-2011-2908
23 Nov 2012 — Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authenticated users to hijack the authentication of arbitrary users for requests that perform operations on MBeans and possibly execute arbitrary code via unspecified vectors. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en JMX Console (jmx-console) en JBoss Enterprise Portal... • http://rhn.redhat.com/errata/RHSA-2012-1152.html • CWE-352: Cross-Site Request Forgery (CSRF) •