PT-2013-3542 · Red Hat · Red Hat Jboss Portal

Published 2013-10-28 · Updated 2013-10-30 · CVE-2013-2102

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:A/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Portal versions prior to 6.1.0

Description The default configuration of Red Hat JBoss Portal enables the JGroups diagnostics service with no authentication when a JGroups channel is started. This allows remote attackers to obtain sensitive information by accessing the service.

Recommendations For versions prior to 6.1.0, update to version 6.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the JGroups diagnostics service until a patch is available. Restrict access to the JGroups channel to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-2102

Affected Products

Red Hat Jboss Portal

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-2102 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1437.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=963984 · Note