CVE-2012-3428

JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains

Published Dec 20, 2012 CVSS 2.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Description
The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource connection in opportunistic circumstances via an invalid connection attempt.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-4802 The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource connection in opportunistic circumstances via an invalid connection attempt.
Github GHSA Github GHSA GHSA-ppg2-ww3w-hq84 User confusion in IronJacamar
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 8:05 PM
Reserved
Jun 14, 2012, 12:00 AM
Status
Modified
Published
Dec 20, 2012, 12:02 PM
Modified
Jun 16, 2026, 11:43 PM
Severity
Moderate
Public date
Dec 18, 2012, 12:00 AM