Design/Logic Flaw

The AuthorizationInterceptor in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 does not properly restrict access, which allows remote authenticated users to bypass intended role restrictions and...

CVE-2012-3369

The CallerIdentityLoginModule in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's...

CVE-2012-5478

CVE-2012-5478 affects JBoss Enterprise Platform components (EAP/Web Platform BRMS/SOA) prior to versions listed; the AuthorizationInterceptor fails to properly restrict access, allowing remote authenticated users to bypass role checks and perform arbitrary JMX operations via unspecified vectors. ...

CVE-2012-5478

The AuthorizationInterceptor in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 does not properly restrict access, which allows remote authenticated users to bypass intended role restrictions and...

CVE-2012-0034

The CVE affects JBoss components where NonManagedConnectionFactory logs the username and password in cleartext during exception handling, risking local disclosure of credentials for EAP 5.1.2/5.2.0, EWP 5.1.2/5.2.0, and BRMS Platform before 5.3.1. Impact is limited to local confidentiality exposu...

CVE-2012-0874

CVE-2012-0874 affects JBoss family products (EAP, EWP, BRMS Platform, SOA Platform) prior to version 5.2.x / 5.3.x where JMXInvokerHAServlet and EJBInvokerHAServlet did not require authentication by default in certain profiles. This can allow a remote attacker to invoke MBean methods and, as note...

CVE-2012-3370

CVE-2012-3370 affects JBoss components (EAP, EWP, BRMS, SOA) prior to the stated versions, where SecurityAssociation.getCredential() returns the previous user’s credentials when no security context is provided, enabling remote privilege escalation to a different user. Red Hat advisories (RHSA/RHB...

CVE-2013-0218

CVE-2013-0218 affects JBoss EAP/EWP 5.2.0 (and possibly 5.1.2); the GUI installer creates a world-readable auto-install XML file that stores the administrator and sucker passwords in plain text. A local user who can access the installer directory could read this file and gain administrative acces...

CVE-2011-4575

CVE-2011-4575 is an XSS vulnerability in the JMX Console of JBoss products (EAP before 5.2.0, EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1) allowing remote injection of script/HTML via unspecified vectors. Connected sources summarize the same CVE as an XSS flaw in t...

CVE-2013-0218

The GUI installer in JBoss Enterprise Application Platform EAP and Enterprise Web Platform EWP 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file...

CVE-2012-3370

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remot...

CVE-2011-4575

Cross-site scripting XSS vulnerability in the JMX console in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

RHEL 5 / 6 : JBoss EAP (RHSA-2013:0231)

Updated JBoss Enterprise Application Platform 6.0.1 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, whi...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update

An updated jbosssx2 package for JBoss Enterprise Application Platform 5.2.0 that fixes one security issue is now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...

JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided

The CallerIdentityLoginModule in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's...

RHEL 4 : JBoss EAP (RHSA-2010:0376)

Updated JBoss Enterprise Application Platform JBEAP 4.2 packages that fix three security issues and multiple bugs are now available for Red Hat Enterprise Linux 4 as JBEAP 4.2.0.CP09. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability...

RHEL 5 : JBoss EAP (RHSA-2009:1649)

Updated JBoss Enterprise Application Platform JBEAP 4.3 packages that fix multiple security issues, several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5 as JBEAP 4.3.0.CP07. This update has been rated as having moderate security impact by the Red Hat Security Respon...

RHEL 5 : JBoss EAP (RHSA-2009:0349)

Updated JBoss Enterprise Application Platform JBoss EAP 4.3 packages that fix various issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.3.0.CP04. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

RHEL 5 / 6 : mod_cluster-native (RHSA-2012:0037)

An updated modcluster-native package that fixes one security issue is now available for JBoss Enterprise Application Platform 5.1.2 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scorin...

RHEL 5 : JBoss EAP (RHSA-2011:0948)

Updated JBoss Enterprise Application Platform 5.1.1 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...