CVE-2011-4608: High severity jboss enterprise application platform vulnerability
It was found that modcluster allowed worker nodes to register on any vhost, regardless of the security constraints applied to other vhosts. In a typical environment there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could exploit this flaw by registering a worker node via an external vhost that is not configured to apply security constraints, then use this worker node to serve malicious content, intercept credentials and hijack user sessions.
Other sources
modcluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4608?
CVE-2011-4608 has a medium security severity rating due to its potential to allow unauthorized worker nodes to register on any vhost.
How do I fix CVE-2011-4608?
To fix CVE-2011-4608, ensure that you limit worker node registrations to the designated internal vhost and implement proper access controls.
What software is affected by CVE-2011-4608?
CVE-2011-4608 affects Red Hat JBoss Enterprise Application Platform version 5.1.2.
What type of vulnerability is CVE-2011-4608?
CVE-2011-4608 is a security misconfiguration vulnerability related to worker nodes registering on incorrect virtual hosts.
Can CVE-2011-4608 lead to data exposure?
Yes, if exploited, CVE-2011-4608 could potentially lead to data exposure by allowing unauthorized access to internal resources.