CVE-2012-0062: Medium severity red hat jboss operations network vulnerability
Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent registration request without a security token.
Other sources
The JON server allows agent registration to succeed under certain conditions if the registration request does not include a security token. This is a feature designed to add convenience. A remote attacker could exploit this by spoofing the identify of an approved agent and passing a null security token, allowing them to hijack the approved agent's session and steal its security token.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0062?
CVE-2012-0062 has a moderate severity rating due to the potential for remote session hijacking.
How do I fix CVE-2012-0062?
To fix CVE-2012-0062, upgrade Red Hat JBoss Operations Network to version 2.4.2 or higher, or 3.0.1 or higher.
What are the affected versions for CVE-2012-0062?
CVE-2012-0062 affects Red Hat JBoss Operations Network versions 2.0.0 to 2.4.1 and 3.0.0.
Who is impacted by CVE-2012-0062?
Organizations using vulnerable versions of Red Hat JBoss Operations Network are impacted by CVE-2012-0062.
Is CVE-2012-0062 exploitable remotely?
Yes, CVE-2012-0062 can be exploited remotely by attackers without a security token.