Authentication flaw

2012-11-2320:55:00

PRIOn knowledge base

www.prio-n.com

6.9 Medium

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.022 Low

EPSS

Percentile

89.3%

JSON

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.

CPENameOperatorVersion
jboss_enterprise_application_platformeq4.3.0
jboss_enterprise_application_platformeq5.0.1
jboss_enterprise_application_platformeq5.1.0
jboss_enterprise_application_platformeq4.2.0
jboss_enterprise_application_platformle5.1.1
jboss_enterprise_application_platformeq5.0.0
jboss_enterprise_brms_platformle5.2.0
jboss_enterprise_portal_platformle4.3.0
jboss_enterprise_soa_platformeq4.3.0
jboss_enterprise_soa_platformeq4.2.0 tp2

Name	Operator	Version
jboss_enterprise_application_platform	eq	4.3.0
jboss_enterprise_application_platform	eq	5.0.1
jboss_enterprise_application_platform	eq	5.1.0
jboss_enterprise_application_platform	eq	4.2.0
jboss_enterprise_application_platform	le	5.1.1
jboss_enterprise_application_platform	eq	5.0.0
jboss_enterprise_brms_platform	le	5.2.0
jboss_enterprise_portal_platform	le	4.3.0
jboss_enterprise_soa_platform	eq	4.3.0
jboss_enterprise_soa_platform	eq	4.2.0 tp2