PT-2010-4047 · Red Hat · Jboss Enterprise Portal Platform+1

Marc Schoenefeld · Published 2010-08-09 · Updated 2010-08-10 · CVE-2010-2474

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Service Bus (ESB) versions prior to 4.7 CP02 in JBoss Enterprise SOA Platform versions prior to 5.0.2

Description The issue is related to the improper consideration of the security domain for a secured service, potentially allowing remote attackers to gain privileges by executing a service.

Recommendations For JBoss Enterprise Service Bus (ESB) versions prior to 4.7 CP02 in JBoss Enterprise SOA Platform versions prior to 5.0.2, update to version 4.7 CP02 or later in JBoss Enterprise SOA Platform version 5.0.2 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-2474

Affected Products

Jboss Enterprise Portal Platform

Jboss Enterprise Service Bus

References · 6

• http://secunia.com/advisories/40568 · Vendor Advisory
• http://secunia.com/advisories/40681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2474 · Security Note
• http://redhat.com/docs/en-US/JBoss_SOA_Platform/5.0.2/html/5.0.2_Release_Notes/index.html · Note
• https://jira.jboss.org/browse/JBESB-3345 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=609442 · Note