CVE-2012-2377 Missing authorization in n/a
Remote attackers on adjacent networks can read sensitive diagnostics information from JBoss platforms due to an unauthenticated JGroups service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-2377?
CVE-2012-2377 is a low-severity missing authorization vulnerability in n/a, published on 23 Nov 2012. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast.
Weakness: CWE-287
Which versions are affected by CVE-2012-2377?
It affects 3 products.
Products include Redhat Jboss Enterprise Brms Platform, Redhat Jboss Enterprise Portal Platform, Redhat Jboss Enterprise Soa Platform.
How do I fix CVE-2012-2377?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2012-2377 being exploited?
There is no known exploitation of CVE-2012-2377 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jm5c-rgfp-cjhx.