Lucene search

Veracode Vulnerability DatabaseVERACODE:10868

HistoryJan 15, 2019 - 8:53 a.m.

Unauthorized Modification

2019-01-1508:53:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

jbossas is vulnerable to unauthorized modification attacks. The vulnerability exists in the (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

CPENameOperatorVersion
jbossaseq4.2.0__6.GA_CP09.11.1.ep1.el5
jbossaseq5.1.1__16.ep5.el5
jbossaseq4.0.4__1.el4s1.20
jbossaseq5.1.2__8.ep5.el4
jbossaseq4.3.0__10.GA_CP10_patch_01.1.ep1.el4
jbossaseq5.1.1__17.ep5.el6
jbossaseq4.2.0__6.GA_CP09.11.ep1.el4
jbossaseq4.2.0__4.GA_CP02.ep1.3.el5.3
jbossaseq4.0.5__1.el4s1.5
jbossaseq4.0.4__1.el4s1.25

Name	Operator	Version
jbossas	eq	4.2.0__6.GA_CP09.11.1.ep1.el5
jbossas	eq	5.1.1__16.ep5.el5
jbossas	eq	4.0.4__1.el4s1.20
jbossas	eq	5.1.2__8.ep5.el4
jbossas	eq	4.3.0__10.GA_CP10_patch_01.1.ep1.el4
jbossas	eq	5.1.1__17.ep5.el6
jbossas	eq	4.2.0__6.GA_CP09.11.ep1.el4
jbossas	eq	4.2.0__4.GA_CP02.ep1.3.el5.3
jbossas	eq	4.0.5__1.el4s1.5
jbossas	eq	4.0.4__1.el4s1.25

Rows per page:

1-10 of 441

References

bugzilla.redhat.com/bugzilla/show_bug.cgi?id=766469

rhn.redhat.com/errata/RHSA-2012-1022.html

rhn.redhat.com/errata/RHSA-2012-1023.html

rhn.redhat.com/errata/RHSA-2012-1024.html

rhn.redhat.com/errata/RHSA-2012-1025.html

rhn.redhat.com/errata/RHSA-2012-1026.html

rhn.redhat.com/errata/RHSA-2012-1027.html

rhn.redhat.com/errata/RHSA-2012-1028.html

rhn.redhat.com/errata/RHSA-2012-1109.html

rhn.redhat.com/errata/RHSA-2012-1125.html

rhn.redhat.com/errata/RHSA-2012-1232.html

rhn.redhat.com/errata/RHSA-2012-1295.html

secunia.com/advisories/49656

secunia.com/advisories/49658

secunia.com/advisories/50084

secunia.com/advisories/50549

www.securityfocus.com/bid/54644

www.securitytracker.com/id?1027501

access.redhat.com/errata/RHSA-2012:1022

access.redhat.com/errata/RHSA-2012:1023

access.redhat.com/errata/RHSA-2012:1024

access.redhat.com/errata/RHSA-2012:1025

access.redhat.com/errata/RHSA-2012:1026

access.redhat.com/errata/RHSA-2012:1027

access.redhat.com/errata/RHSA-2012:1028

access.redhat.com/errata/RHSA-2012:1109

access.redhat.com/errata/RHSA-2012:1125

access.redhat.com/errata/RHSA-2012:1232

access.redhat.com/errata/RHSA-2012:1295

access.redhat.com/security/cve/CVE-2011-4605

access.redhat.com/security/updates/classification/#important

bugzilla.redhat.com/show_bug.cgi?id=766469

rhn.redhat.com/errata/RHSA-2012-1025.html

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Related for VERACODE:10868