CVE-2011-1483

JBossWS remote Denial of Service

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

wsf/common/DOMUtils.java en JBossWS Native en Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, y 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 y 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, y 5.1.0; JBoss Communications Platform 1.2.11 y 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; y JBoss Enterprise Web Platform 5.1.1, no manejan adecuadamente la recursividad durante la expansión de una entidad, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de memoria y CPU) a través de una petición manipulada que contiene un documento XML una declaración DOCTYPE y un gran número de referencias a entidades anidadas. Similar cuestión que el CVE-2003-1564.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-03-21 CVE Reserved
2011-09-15 CVE Published
2023-03-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
http://source.jboss.org/changelog/JBossWS/?cs=13996	2019-10-09

URL	Date	SRC
https://bugzilla.redhat.com/show_bug.cgi?id=692584	2011-09-15
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03824583	2019-10-09
https://access.redhat.com/security/cve/CVE-2011-1483	2011-09-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Jboss Communications Platform Search vendor "Redhat" for product "Jboss Communications Platform"				1.2.11 Search vendor "Redhat" for product "Jboss Communications Platform" and version "1.2.11"		-		Affected
Redhat Search vendor "Redhat"		Jboss Communications Platform Search vendor "Redhat" for product "Jboss Communications Platform"				5.1.1 Search vendor "Redhat" for product "Jboss Communications Platform" and version "5.1.1"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"				4.2.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "4.2.0"		cp09		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"				4.3.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "4.3.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"				5.1.1 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "5.1.1"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Brms Platform Search vendor "Redhat" for product "Jboss Enterprise Brms Platform"				5.1.0 Search vendor "Redhat" for product "Jboss Enterprise Brms Platform" and version "5.1.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Portal Platform Search vendor "Redhat" for product "Jboss Enterprise Portal Platform"				4.3.0 Search vendor "Redhat" for product "Jboss Enterprise Portal Platform" and version "4.3.0"		cp06		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Portal Platform Search vendor "Redhat" for product "Jboss Enterprise Portal Platform"				5.1.1 Search vendor "Redhat" for product "Jboss Enterprise Portal Platform" and version "5.1.1"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Soa Platform Search vendor "Redhat" for product "Jboss Enterprise Soa Platform"				4.2.0 Search vendor "Redhat" for product "Jboss Enterprise Soa Platform" and version "4.2.0"		cp05		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Soa Platform Search vendor "Redhat" for product "Jboss Enterprise Soa Platform"				4.3.0 Search vendor "Redhat" for product "Jboss Enterprise Soa Platform" and version "4.3.0"		cp05		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Soa Platform Search vendor "Redhat" for product "Jboss Enterprise Soa Platform"				5.1.0 Search vendor "Redhat" for product "Jboss Enterprise Soa Platform" and version "5.1.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Web Platform Search vendor "Redhat" for product "Jboss Enterprise Web Platform"				5.1.1 Search vendor "Redhat" for product "Jboss Enterprise Web Platform" and version "5.1.1"		-		Affected
Hp Search vendor "Hp"		Network Node Manager I Search vendor "Hp" for product "Network Node Manager I"				9.0 Search vendor "Hp" for product "Network Node Manager I" and version "9.0"		-		Affected
Hp Search vendor "Hp"		Network Node Manager I Search vendor "Hp" for product "Network Node Manager I"				9.01 Search vendor "Hp" for product "Network Node Manager I" and version "9.01"		-		Affected
Hp Search vendor "Hp"		Network Node Manager I Search vendor "Hp" for product "Network Node Manager I"				9.02 Search vendor "Hp" for product "Network Node Manager I" and version "9.02"		-		Affected
Hp Search vendor "Hp"		Network Node Manager I Search vendor "Hp" for product "Network Node Manager I"				9.03 Search vendor "Hp" for product "Network Node Manager I" and version "9.03"		-		Affected
Hp Search vendor "Hp"		Network Node Manager I Search vendor "Hp" for product "Network Node Manager I"				9.10 Search vendor "Hp" for product "Network Node Manager I" and version "9.10"		-		Affected