PT-2012-4703 · Jboss · Ironjacamar

Jesper Pedersen · Published 2012-12-20 · Updated 2022-05-17 · CVE-2012-3428

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IronJacamar container versions prior to 1.0.12.Final for JBoss Application Server

Description The issue allows remote attackers to obtain access to an arbitrary datasource connection under certain circumstances, specifically when allow-multiple-users is enabled in conjunction with a security domain. This occurs because the credentials supplied in a getConnection function call are not used, enabling attackers to gain access via an invalid connection attempt.

Recommendations For IronJacamar container versions prior to 1.0.12.Final, update to version 1.0.12.Final or later to resolve the issue.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2012-3428

GHSA-PPG2-WW3W-HQ84

RHSA-2012:1591

RHSA-2012:1592

Affected Products

Ironjacamar

References · 10

• http://rhn.redhat.com/errata/RHSA-2012-1594.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1592.html · Vendor Advisory
• https://issues.jboss.org/browse/JBJCA-864 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ppg2-ww3w-hq84 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1591.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3428 · Security Note
• https://issues.jboss.org/browse/JBPAPP-9584 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=843358 · Note
• http://secunia.com/advisories/51607 · Note
• https://issues.jboss.org/secure/ReleaseNote.jspa?projectId=12310691&version=12319522 · Note