CVE-2011-4605
At a glance
- Source
- NVD
- EPSS
- EPSS 3.52 % · percentile 89 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.
Weaknesses (CWE)
References
- http://www.securitytracker.com/id?1027501
- http://secunia.com/advisories/49656
- http://rhn.redhat.com/errata/RHSA-2012-1028.html
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=766469
- http://secunia.com/advisories/49658
- http://rhn.redhat.com/errata/RHSA-2012-1109.html
- http://rhn.redhat.com/errata/RHSA-2012-1025.html
- http://secunia.com/advisories/50084
- http://rhn.redhat.com/errata/RHSA-2012-1295.html
- http://rhn.redhat.com/errata/RHSA-2012-1027.html
- http://www.securityfocus.com/bid/54644
- http://rhn.redhat.com/errata/RHSA-2012-1026.html
- http://secunia.com/advisories/50549
- http://rhn.redhat.com/errata/RHSA-2012-1024.html
- http://rhn.redhat.com/errata/RHSA-2012-1232.html
- http://rhn.redhat.com/errata/RHSA-2012-1022.html
- http://rhn.redhat.com/errata/RHSA-2012-1023.html
- http://rhn.redhat.com/errata/RHSA-2012-1125.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2011-4529
- GCVE · GCVE-0-2011-4605
CERT-FR advisories
- CERTA-2013-AVI-440 — Multiples vulnérabilités dans HP Network Node Manager I · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp10:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:*≤ 5.2.0cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:cp07:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp05:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp05:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.1.2:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |