CVE-2012-0874observed exploitation

CVE-2012-0874

50Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actepss 16%

from disclosure to weapon309 days

Published on NVDFeb 5

1st PoC+309d

VulnCheck+1877d

exploitation probability

16%top 4% of all CVEs

observed exploitation

yesVulnCheck

2 public exploit(s)

The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/30211unverified exploitdbwww.exploit-db.com/exploits/30211unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References