CVE-2013-4112 Exposure of Sensitive Information to an Unauthorized Actor in JGroup
Remote attackers with valid credentials can access diagnostic information and execute arbitrary code in JGroups.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-4112?
CVE-2013-4112 is a medium-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 28 Sep 2013. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.
Weakness: CWE-200
Which versions are affected by CVE-2013-4112?
4 open source packages ship an affected version, including org.jgroups:jgroups. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.jgroups:jgroups Maven | From 3.0.0 | 3.2.9.Final |
org.jgroups:jgroups Maven | From 3.0.0 | 3.2.9.Final |
org.jgroups:jgroups Maven | From 3.3.0 | 3.3.3.Final |
org.jgroups:jgroups Maven | From 3.3.0 | 3.3.3.Final |
Products include Jgroups Jgroup, Redhat Jboss Enterprise Application Platform.
How do I fix CVE-2013-4112?
Upgrade org.jgroups:jgroups to a fixed version for your release line: 3.2.9.Final or 3.3.3.Final.
Is CVE-2013-4112 being exploited?
There is no known exploitation of CVE-2013-4112 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2013-4112, GHSA-cc62-496p-hrr7.