PT-2012-1927 · Red Hat · Red Hat Jboss Enterprise Application Platform
David Jorm
·
Published
2012-01-27
·
Updated
2023-02-13
·
CVE-2011-4608
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
JBoss Enterprise Application Platform version 5.1.2
Description
The issue allows worker nodes to register with arbitrary virtual hosts, enabling remote attackers to bypass intended access restrictions. This can lead to the provision of malicious content, session hijacking, and credential theft by registering from an external vhost that does not enforce security constraints.
Recommendations
For JBoss Enterprise Application Platform version 5.1.2, consider restricting worker node registrations to only trusted virtual hosts to minimize the risk of exploitation. As a temporary workaround, restrict access to sensitive areas of the application until a more permanent solution is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat Jboss Enterprise Application Platform