CVE-2012-1167 Missing authorization in n/a

What is CVE-2012-1167?

CVE-2012-1167 is a medium-severity missing authorization vulnerability in Redhat Jboss Enterprise Application Platform, published on 23 Nov 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.

Weakness: CWE-264

Which versions are affected by CVE-2012-1167?

It affects 4 products.

Products include Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Brms Platform, Redhat Jboss Enterprise Soa Platform, Redhat Jboss Enterprise Web Platform.

How do I fix CVE-2012-1167?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2012-1167 being exploited?

There is no known exploitation of CVE-2012-1167 in the wild and no public exploit code.

Other vulnerabilities in Redhat Jboss Enterprise Application Platform

• CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution Exploited Critical 9.8
• CVE-2010-1428 Red Hat JBoss Information Disclosure Exploited Medium 5.9
• CVE-2010-0738 Red Hat JBoss Authentication Bypass Exploited Low 3.7
• CVE-2016-3690 Deserialization in n/a Critical 9.8
• CVE-2017-7504 Deserialization in JBoss Critical 9.8

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9f9q-j576-jp97.