CVE-2012-4572

2013-10-2821:55:00

CWE-264

[email protected]

web.nvd.nist.gov

red hat

jboss

eap

portal

cve-2012-4572

authorization

security vulnerability

nvd

5.4 Medium

AI Score

Confidence

High

3.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:H/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications’ authorization decisions via a crafted application.

CPENameOperatorVersion
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.1.2
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq4.3.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.0.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.2.2
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.1.1
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.0.1
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.1.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.2.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.2.1
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformle6.0.1

CPE	Name	Operator	Version
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.1.2
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	4.3.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.0.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.2.2
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.1.1
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.0.1
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.1.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.2.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.2.1
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	le	6.0.1