CVE-2012-2377

Published: Nov 23, 2012Modified: Apr 29, 2026

3.3

Vector

AV:A/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 6.5 / Impact: 2.9

Source: NVD

Description

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast.

Affected (28)

Products: Redhat: Jboss Enterprise Portal Platform, Jboss Enterprise Soa Platform, Jboss Enterprise Brms Platform

3 products

Jboss Enterprise Portal Platform

Jboss Enterprise Soa Platform

Jboss Enterprise Brms Platform

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Portal Platform	Up to 5.2.1
Redhat Jboss Enterprise Portal Platform	Version 4.3.0
Redhat Jboss Enterprise Portal Platform	Version 4.3.0 cp07
Redhat Jboss Enterprise Portal Platform	Version 5.0.0
Redhat Jboss Enterprise Portal Platform	Version 5.0.1
Redhat Jboss Enterprise Portal Platform	Version 5.1.0
Redhat Jboss Enterprise Portal Platform	Version 5.1.1
Redhat Jboss Enterprise Portal Platform	Version 5.2.0

Configuration B

19 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Soa Platform	Up to 5.2.0
Redhat Jboss Enterprise Soa Platform	Version 4.2.0
Redhat Jboss Enterprise Soa Platform	Version 4.2.0 cp01
Redhat Jboss Enterprise Soa Platform	Version 4.2.0 cp02
Redhat Jboss Enterprise Soa Platform	Version 4.2.0 cp03
Redhat Jboss Enterprise Soa Platform	Version 4.2.0 cp04
Redhat Jboss Enterprise Soa Platform	Version 4.2.0 cp05
Redhat Jboss Enterprise Soa Platform	Version 4.2.0 tp02
Redhat Jboss Enterprise Soa Platform	Version 4.3.0
Redhat Jboss Enterprise Soa Platform	Version 4.3.0 cp01
Redhat Jboss Enterprise Soa Platform	Version 4.3.0 cp02
Redhat Jboss Enterprise Soa Platform	Version 4.3.0 cp03
Redhat Jboss Enterprise Soa Platform	Version 4.3.0 cp04
Redhat Jboss Enterprise Soa Platform	Version 4.3.0 cp05
Redhat Jboss Enterprise Soa Platform	Version 5.0.0
Redhat Jboss Enterprise Soa Platform	Version 5.0.1
Redhat Jboss Enterprise Soa Platform	Version 5.0.2
Redhat Jboss Enterprise Soa Platform	Version 5.1.0
Redhat Jboss Enterprise Soa Platform	Version 5.1.1

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Brms Platform	Up to 5.2.0

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (38)

http://rhn.redhat.com/errata/RHSA-2012-1028.html

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2012-1125.html

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2012-1232.html

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-0191.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0192.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0193.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0194.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0195.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0196.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0197.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0198.html

Source: secalert@redhat.com

http://secunia.com/advisories/49669

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/50084

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/50549

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/51984

Source: secalert@redhat.com

http://www.osvdb.org/83085

Source: secalert@redhat.com

http://www.securityfocus.com/bid/54183

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=823392

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/76540

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1028.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2012-1125.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2012-1232.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-0191.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0192.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0193.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0194.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0195.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0196.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0197.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0198.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/49669

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/50084

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/50549

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/51984

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/83085

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/54183

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=823392

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/76540

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.