CVE-2011-4605

2012-11-2320:55:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2011-4605

jboss

eap

web platform

soa platform

portal platform

brms platform

security vulnerability

remote attack

6.5 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.016 Low

EPSS

Percentile

87.4%

JSON

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

CPENameOperatorVersion
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq4.3.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.1.2
redhat:jboss_enterprise_web_platformredhat jboss enterprise web platformeq5.1.2
redhat:jboss_enterprise_portal_platformredhat jboss enterprise portal platformeq5.2.1
redhat:jboss_enterprise_portal_platformredhat jboss enterprise portal platformeq4.3.0
redhat:jboss_enterprise_brms_platformredhat jboss enterprise brms platformle5.2.0
redhat:jboss_enterprise_soa_platformredhat jboss enterprise soa platformeq4.2.0
redhat:jboss_enterprise_portal_platformredhat jboss enterprise portal platformeq5.2.0
redhat:jboss_enterprise_soa_platformredhat jboss enterprise soa platformeq4.3.0

CPE	Name	Operator	Version
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	4.3.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.1.2
redhat:jboss_enterprise_web_platform	redhat jboss enterprise web platform	eq	5.1.2
redhat:jboss_enterprise_portal_platform	redhat jboss enterprise portal platform	eq	5.2.1
redhat:jboss_enterprise_portal_platform	redhat jboss enterprise portal platform	eq	4.3.0
redhat:jboss_enterprise_brms_platform	redhat jboss enterprise brms platform	le	5.2.0
redhat:jboss_enterprise_soa_platform	redhat jboss enterprise soa platform	eq	4.2.0
redhat:jboss_enterprise_portal_platform	redhat jboss enterprise portal platform	eq	5.2.0
redhat:jboss_enterprise_soa_platform	redhat jboss enterprise soa platform	eq	4.3.0