PT-2013-1690 · Red Hat · Red Hat Jboss Portal+1

Published 2013-10-28 · Updated 2013-10-30 · CVE-2012-4572

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform (EAP) versions prior to 6.1.0 Red Hat JBoss Portal versions prior to 6.1.0

Description The issue allows local users to control certain applications' authorization decisions via a crafted application. This occurs because the implementation of a custom authorization module for a new application is not loaded when an implementation is already loaded and the modules share class names.

Recommendations For Red Hat JBoss Enterprise Application Platform (EAP) versions prior to 6.1.0, update to version 6.1.0 or later. For Red Hat JBoss Portal versions prior to 6.1.0, update to version 6.1.0 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4572

RHSA-2013:0834

RHSA-2013:0839

Affected Products

Red Hat Jboss Enterprise Application Platform

Red Hat Jboss Portal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-4572 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1437.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0833.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0834.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4572 · Note