Input validation

2012-11-2320:55:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.016 Low

EPSS

Percentile

87.3%

JSON

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

CPENameOperatorVersion
jboss_enterprise_application_platformeq4.3.0 cp10
jboss_enterprise_application_platformeq5.1.2
jboss_enterprise_brms_platformle5.2.0
jboss_enterprise_portal_platformeq5.2.1
jboss_enterprise_portal_platformeq4.3.0 cp7
jboss_enterprise_portal_platformeq5.2.0
jboss_enterprise_soa_platformeq4.2.0 cp5
jboss_enterprise_soa_platformeq4.3.0 cp5
jboss_enterprise_web_platformeq5.1.2

Name	Operator	Version
jboss_enterprise_application_platform	eq	4.3.0 cp10
jboss_enterprise_application_platform	eq	5.1.2
jboss_enterprise_brms_platform	le	5.2.0
jboss_enterprise_portal_platform	eq	5.2.1
jboss_enterprise_portal_platform	eq	4.3.0 cp7
jboss_enterprise_portal_platform	eq	5.2.0
jboss_enterprise_soa_platform	eq	4.2.0 cp5
jboss_enterprise_soa_platform	eq	4.3.0 cp5
jboss_enterprise_web_platform	eq	5.1.2