CVE-2012-0874 Auth bypass in n/a

Medium 6.8 Published 5 Feb 2013 Updated 6 Aug 2024

Remote attackers can execute arbitrary code by invoking MBean methods if JBoss invoker servlets lack proper secondary authentication configuration.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2012-0874?

CVE-2012-0874 is a medium-severity authentication bypass vulnerability in Redhat Jboss Enterprise Application Platform, published on 5 Feb 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.

Weakness: CWE-287

Which versions are affected by CVE-2012-0874?

It affects 3 products.

Products include Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Brms Platform, Redhat Jboss Enterprise Web Platform.

How do I fix CVE-2012-0874?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2012-0874 being exploited?

There is no known exploitation of CVE-2012-0874 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

Also known as GHSA-cjrh-9rp2-h6f2.