CVE-2011-4608

mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.redhat.com/support/errata/RHSA-2012-0035.html	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=767020
http://www.redhat.com/support/errata/RHSA-2012-0037.html	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2012-0039.html	Vendor Advisory
http://www.securityfocus.com/bid/51554
http://www.securitytracker.com/id?1026545
http://www.redhat.com/support/errata/RHSA-2012-0036.html	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2012-0040.html	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2012-0038.html	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/72460

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*

Information

Published : 2012-01-27 07:55

Updated : 2023-02-12 19:23

NVD link : CVE-2011-4608

Mitre link : CVE-2011-4608

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

redhat

jboss_enterprise_application_platform

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.redhat.com/support/errata/RHSA-2012-0035.html", "name": "RHSA-2012:0035", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=767020", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=767020", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.redhat.com/support/errata/RHSA-2012-0037.html", "name": "RHSA-2012:0037", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.redhat.com/support/errata/RHSA-2012-0039.html", "name": "RHSA-2012:0039", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.securityfocus.com/bid/51554", "name": "51554", "tags": [], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id?1026545", "name": "1026545", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.redhat.com/support/errata/RHSA-2012-0036.html", "name": "RHSA-2012:0036", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.redhat.com/support/errata/RHSA-2012-0040.html", "name": "RHSA-2012:0040", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.redhat.com/support/errata/RHSA-2012-0038.html", "name": "RHSA-2012:0038", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72460", "name": "jboss-modcluster-security-bypass(72460)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-4608", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2012-01-27T15:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-02-13T03:23Z"}