CVE-2011-4605
En bref
- Source
- NVD
- EPSS
- EPSS 3.52 % · centile 89 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Rechercher sur…
Description
The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.
Faiblesses (CWE)
Références
- http://www.securitytracker.com/id?1027501
- http://secunia.com/advisories/49656
- http://rhn.redhat.com/errata/RHSA-2012-1028.html
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=766469
- http://secunia.com/advisories/49658
- http://rhn.redhat.com/errata/RHSA-2012-1109.html
- http://rhn.redhat.com/errata/RHSA-2012-1025.html
- http://secunia.com/advisories/50084
- http://rhn.redhat.com/errata/RHSA-2012-1295.html
- http://rhn.redhat.com/errata/RHSA-2012-1027.html
- http://www.securityfocus.com/bid/54644
- http://rhn.redhat.com/errata/RHSA-2012-1026.html
- http://secunia.com/advisories/50549
- http://rhn.redhat.com/errata/RHSA-2012-1024.html
- http://rhn.redhat.com/errata/RHSA-2012-1232.html
- http://rhn.redhat.com/errata/RHSA-2012-1022.html
- http://rhn.redhat.com/errata/RHSA-2012-1023.html
- http://rhn.redhat.com/errata/RHSA-2012-1125.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2011-4529
- GCVE · GCVE-0-2011-4605
Avis du CERT-FR
- CERTA-2013-AVI-440 — Multiples vulnérabilités dans HP Network Node Manager I · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp10:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:*≤ 5.2.0cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:cp07:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp05:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp05:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.1.2:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |