Unscored severity · published Nov 23, 2012
CVE-2012-2377
JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when…
–
CVSS
1.4%
EPSS
No
On KEV
Description
JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jboss Enterprise Brms Platform · Redhat
through 5.2.0 · source: NVD
JE
Jboss Enterprise Portal Platform · Redhat
through 5.2.1; 4.3.0; 4.3.0; 5.0.0; 5.0.1; 5.1.0; +2 more · source: NVD
JE
Jboss Enterprise Soa Platform · Redhat
through 5.2.0; 4.2.0; 4.2.0; 4.2.0; 4.2.0; 4.2.0; +13 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2377
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2377
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1028.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1125.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1232.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0191.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0192.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0193.html
More from Jboss Enterprise Brms Platform
9.8
CVE-2015-7501
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;…
9.8
CVE-2016-4999
SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows…
8.8
CVE-2016-5401
Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances…
–
CVE-2015-0250
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or…
–
CVE-2014-0005
PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to…