PT-2012-1801 · Red Hat · Jboss Soa Platform+3

David Jorm · Published 2012-11-23 · Updated 2023-02-13 · CVE-2011-4085

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform versions prior to 5.1.2 JBoss SOA Platform versions prior to 5.2.0 JBoss BRMS Platform versions prior to 5.3.0 JBoss Portal Platform versions prior to 4.3 CP07

Description The issue allows remote attackers to bypass authentication in JBoss platforms by sending a request with a method other than GET or POST, due to inadequate access control.

Recommendations For JBoss Enterprise Application Platform versions prior to 5.1.2, update to version 5.1.2 or later. For JBoss SOA Platform versions prior to 5.2.0, update to version 5.2.0 or later. For JBoss BRMS Platform versions prior to 5.3.0, update to version 5.3.0 or later. For JBoss Portal Platform versions prior to 4.3 CP07, update to version 4.3 CP07 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-4085

RHSA-2011:1798

RHSA-2011:1799

RHSA-2011:1800

Affected Products

Jboss Brms Platform

Red Hat Jboss Enterprise Application Platform

Jboss Portal Platform

Jboss Soa Platform

References · 13

• http://rhn.redhat.com/errata/RHSA-2011-1456.html · Vendor Advisory
• http://secunia.com/advisories/47866 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4085 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-0091.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1798.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1822.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1805.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1799.html · Vendor Advisory
• http://secunia.com/advisories/47169 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1800.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1028.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=750422 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4085 · Note