CVE-2007-1036
First published: Wed Feb 21 2007(Updated: )
The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| JBoss Application Server | ||
| Red Hat JBoss Application Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/archive/1/460695/100/0/threaded
- http://www.kb.cert.org/vuls/id/632656
- http://wiki.jboss.org/wiki/Wiki.jsp?page=SecureJBoss
- http://wiki.jboss.org/wiki/Wiki.jsp?page=SecureTheJmxConsole
- http://www.securitytracker.com/id?1017677
- http://osvdb.org/33744
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32596
- http://www.securityfocus.com/archive/1/460605/100/0/threaded
- http://www.securityfocus.com/archive/1/460597/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2007-1036?
CVE-2007-1036 has a high severity level due to the potential for unauthorized access to the JBoss administrative interfaces.
How do I fix CVE-2007-1036?
To fix CVE-2007-1036, update your JBoss configuration to enforce authentication on the console and web management interfaces.
What systems are affected by CVE-2007-1036?
CVE-2007-1036 affects systems running Red Hat JBoss Application Server with default configurations.
Can CVE-2007-1036 be exploited remotely?
Yes, CVE-2007-1036 can be exploited remotely, allowing attackers to gain administrative access without authentication.
Is there a workaround for CVE-2007-1036?
Yes, a workaround for CVE-2007-1036 is to manually configure user authentication for the affected interfaces in JBoss.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- collector/nvd-historical
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- vendor/jboss
- canonical/jboss application server
- canonical/red hat jboss application server