Race condition

2007-07-2721:30:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.6%

JSON

The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by logging in during a session by a more privileged administrator, as demonstrated by privilege escalation from Read Mode to Write Mode.

CPENameOperatorVersion
jboss_application_servereq4.0.2-ga-cp4
jboss_application_servereq4.0.5-ga
jboss_application_servereq4.0.5-cp01
jboss_application_servereq4.0.2-ga-cp2
jboss_application_servereq4.0.2-ga-cp3
jboss_application_servereq4.0.5-cp02

Name	Operator	Version
jboss_application_server	eq	4.0.2-ga-cp4
jboss_application_server	eq	4.0.5-ga
jboss_application_server	eq	4.0.5-cp01
jboss_application_server	eq	4.0.2-ga-cp2
jboss_application_server	eq	4.0.2-ga-cp3
jboss_application_server	eq	4.0.5-cp02