CVE-2012-4572

JBoss: custom authorization module implementations shared between applications

Published Oct 28, 2013 CVSS 2.0 · 3.7 Low EPSS < 1% KEV · Not listed
Description
Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications' authorization decisions via a crafted application.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2012-4499 Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications' authorization decisions via a crafted application.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 8:42 PM
Reserved
Aug 21, 2012, 12:00 AM
Status
Modified
Published
Oct 28, 2013, 9:55 PM
Modified
Jun 16, 2026, 11:45 PM
Severity
Low
Public date
May 20, 2013, 12:00 AM