9.4 High
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.022 Low
EPSS
Percentile
89.4%
The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.
rhn.redhat.com/errata/RHSA-2011-1456.html
rhn.redhat.com/errata/RHSA-2011-1798.html
rhn.redhat.com/errata/RHSA-2011-1799.html
rhn.redhat.com/errata/RHSA-2011-1800.html
rhn.redhat.com/errata/RHSA-2011-1805.html
rhn.redhat.com/errata/RHSA-2011-1822.html
rhn.redhat.com/errata/RHSA-2012-0091.html
rhn.redhat.com/errata/RHSA-2012-1028.html
secunia.com/advisories/47169
secunia.com/advisories/47866
bugzilla.redhat.com/show_bug.cgi?id=750422