CVE-2014-0245 Race condition in JBoss Portal
An unauthenticated attacker can exploit a race condition in JBoss Portal to gain privileged information when WS-Security is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-0245?
CVE-2014-0245 is a medium-severity vulnerability in Red Hat JBoss Portal, published on 2 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer, and the endpoint in question is being used by a privileged user. This affects JBoss Portal 6.2.0.
Weakness: CWE-362
Which versions are affected by CVE-2014-0245?
It affects 1 product.
Products include Redhat Jboss Portal.
How do I fix CVE-2014-0245?
No fix has been published for CVE-2014-0245 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-0245 being exploited?
There is no known exploitation of CVE-2014-0245 in the wild and no public exploit code.
Other vulnerabilities in Red Hat JBoss Portal
Sources
Also known as GHSA-4xc9-63p3-pjqr.