PT-2012-4703 · Jboss · Ironjacamar

Jesper Pedersen · Publicado 2012-12-20 · Atualizado 2022-05-17 · CVE-2012-3428

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IronJacamar container versions prior to 1.0.12.Final for JBoss Application Server

Description The issue allows remote attackers to obtain access to an arbitrary datasource connection under certain circumstances, specifically when allow-multiple-users is enabled in conjunction with a security domain. This occurs because the credentials supplied in a getConnection function call are not used, enabling attackers to gain access via an invalid connection attempt.

Recommendations For IronJacamar container versions prior to 1.0.12.Final, update to version 1.0.12.Final or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2012-3428

GHSA-PPG2-WW3W-HQ84

RHSA-2012:1591

RHSA-2012:1592

Produtos afetados

Ironjacamar

Referências · 10

• http://rhn.redhat.com/errata/RHSA-2012-1594.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-1592.html · Aviso do Fabricante
• https://issues.jboss.org/browse/JBPAPP-9584 · Nota
• https://issues.jboss.org/browse/JBJCA-864 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=843358 · Nota
• https://osv.dev/vulnerability/GHSA-ppg2-ww3w-hq84 · Aviso do Fabricante
• http://secunia.com/advisories/51607 · Nota
• https://issues.jboss.org/secure/ReleaseNote.jspa?projectId=12310691&version=12319522 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-1591.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3428 · Nota de Segurança