CVSS: 4.6EPSS: 0%CPEs: 13EXPL: 0CVE-2012-1167 – JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm
https://notcve.org/view.php?id=CVE-2012-1167
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications. El JBoss Server en JBoss Enterprise Application Platform v5.1.x anterior a v5.1.2 y v5.2.x anterior a v5.2.2, Web Platform anterior a v5.1.2, BRMS Platform anterior a v5.3.0, y SOA Platform anterior a v5.3.0, cuando el servidor está configurado para utilizar el JaccAuthorizationRealm y la propiedad ignoreBaseDecision se establece en true en el JBossWebRealm, no comprueba correctamente los permisos creados por la clase WebPermissionMapping, permitiendo a usuarios remotos autenticados acceder a aplicaciones arbitrarias. • http://rhn.redhat.com/errata/RHSA-2012-1013.html http://rhn.redhat.com/errata/RHSA-2012-1014.html http://rhn.redhat.com/errata/RHSA-2012-1026.html http://rhn.redhat.com/errata/RHSA-2012-1027.html http://rhn.redhat.com/errata/RHSA-2012-1028.html http://rhn.redhat.com/errata/RHSA-2012-1125.html http://rhn.redhat.com/errata/RHSA-2012-1232.html http://secunia.com/advisories/49635 http://secunia.com/advisories/49658 http://secunia.com/advisories/50549 http:/&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.1EPSS: 0%CPEs: 5EXPL: 0CVE-2012-0034 – Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs
https://notcve.org/view.php?id=CVE-2012-0034
The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file. El NonManagedConnectionFactory en JBoss Enterprise Application Platform (EAP) v5.1.2 y v5.2.0, Web Platform (EWP) v5.1.2 y v5.2.0, y BRMS Platform anterior a v5.3.1 guarda el nombre de usuario y el password en texto plano cuando una excepción es lanzada, lo que permite a usuarios locales obtener información sensible mediante la lectura de un fichero de log. • http://rhn.redhat.com/errata/RHSA-2012-0108.html http://rhn.redhat.com/errata/RHSA-2012-1072.html http://rhn.redhat.com/errata/RHSA-2013-0191.html http://rhn.redhat.com/errata/RHSA-2013-0192.html http://rhn.redhat.com/errata/RHSA-2013-0193.html http://rhn.redhat.com/errata/RHSA-2013-0195.html http://rhn.redhat.com/errata/RHSA-2013-0196.html http://rhn.redhat.com/errata/RHSA-2013-0197.html http://rhn.redhat.com/errata/RHSA-2013-0221.html http://rhn • CWE-255: Credentials Management Errors •
CVSS: 6.8EPSS: 2%CPEs: 26EXPL: 0CVE-2011-4085 – Invoker servlets authentication bypass (HTTP verb tampering)
https://notcve.org/view.php?id=CVE-2011-4085
The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression. Los servlets invocados por httpha-invoker en JBoss Enterprise Application Platform anterior a v5.1.2, SOA Platform anterior a v5.2.0, BRMS Platform anterior a v5.3.0, y Portal Platform anterior a v4.3 CP07 lleva a cabo el control de acceso sólo para los métodos GET y POST, lo que permite a atacantes remotos evitar la autenticación mediante el envío de una solicitud con un método diferente. NOTA: esta vulnerabilidad se debe a CVE-2010-0738 • http://rhn.redhat.com/errata/RHSA-2011-1456.html http://rhn.redhat.com/errata/RHSA-2011-1798.html http://rhn.redhat.com/errata/RHSA-2011-1799.html http://rhn.redhat.com/errata/RHSA-2011-1800.html http://rhn.redhat.com/errata/RHSA-2011-1805.html http://rhn.redhat.com/errata/RHSA-2011-1822.html http://rhn.redhat.com/errata/RHSA-2012-0091.html http://rhn.redhat.com/errata/RHSA-2012-1028.html http://secunia.com/advisories/47169 http://secunia.com/advisories • CWE-287: Improper Authentication •