CVE-2013-2102

Published: Oct 28, 2013Modified: Apr 29, 2026

3.3

Vector

AV:A/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 6.5 / Impact: 2.9

Source: NVD

Description

The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive information (diagnostics) by accessing the service.

Affected (9)

Products: Redhat: Jboss Enterprise Portal Platform

Redhat

1 product

Jboss Enterprise Portal Platform

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Portal Platform	Up to 6.0.0
Redhat Jboss Enterprise Portal Platform	Version 4.3.0
Redhat Jboss Enterprise Portal Platform	Version 5.0.0
Redhat Jboss Enterprise Portal Platform	Version 5.0.1
Redhat Jboss Enterprise Portal Platform	Version 5.1.0
Redhat Jboss Enterprise Portal Platform	Version 5.1.1
Redhat Jboss Enterprise Portal Platform	Version 5.2.0
Redhat Jboss Enterprise Portal Platform	Version 5.2.1
Redhat Jboss Enterprise Portal Platform	Version 5.2.2

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

http://rhn.redhat.com/errata/RHSA-2013-1437.html

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=963984

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1437.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=963984

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.