Unscored severity · published Nov 23, 2012
CVE-2011-1096
The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block…
–
CVSS
2.6%
EPSS
No
On KEV
Description
The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining (CBC) mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on SOAP responses, aka "character encoding pattern attack."
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jboss Enterprise Portal Platform · Redhat
through 5.2.1; 5.0.0; 5.0.1; 5.1.0; 5.1.1; 5.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1096
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1096
aktuell.ruhr-uni-bochum.de
http://aktuell.ruhr-uni-bochum.de/pm2011/pm00330.html.de
coheigea.blogspot.com
http://coheigea.blogspot.com/2012/04/note-on-cve-2011-1096.html
cxf.apache.org
http://cxf.apache.org/note-on-cve-2011-1096.html
dl.acm.org
http://dl.acm.org/citation.cfm?id=2046756&dl=ACM&coll=DL
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-1301.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-1330.html
More from Jboss Enterprise Portal Platform
–
CVE-2015-3244
The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in portlets with the default resource serving for GenericPortlet, does not properly restrict…
–
CVE-2014-7852
Cross-site scripting (XSS) vulnerability in JBoss RichFaces, as used in JBoss Portal 6.1.1, allows remote attackers to inject arbitrary web script or HTML via crafted URL, which…
–
CVE-2014-3518
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red…
–
CVE-2011-4580
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via…
–
CVE-2011-2941
Open redirect vulnerability in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks…