CVE-2012-3369: Medium severity redhat Jboss Enterprise Web Platform vulnerability
The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's password to be used.
Other sources
The CallerIdentityLoginModule will retain the password from the previous call if a null password is provided, and pass the provided username along with the previously provided password as credentials for the current Principal. If the CallerIdentityLoginModule was utilized in a way that allowed a user to authenticate with a null password (rather than an empty string), then a remote attacker could exploit this flaw to hijack the credentials of a previously authenticated user if they knew their username, and were able to time their login attempt so it immediately followed a call made by the previously authenticated user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3369?
CVE-2012-3369 is considered a high severity vulnerability as it allows remote attackers to gain unauthorized privileges.
How do I fix CVE-2012-3369?
To fix CVE-2012-3369, you should upgrade to JBoss Enterprise Application Platform version 5.2.0 or later, or the appropriate version of the affected platforms.
Which software versions are affected by CVE-2012-3369?
CVE-2012-3369 affects JBoss Enterprise Application Platform and JBoss Enterprise Web Platform versions before 5.2.0 and JBoss Enterprise BRMS Platform versions up to and including 5.3.0.
What impact does CVE-2012-3369 have on my system?
The impact of CVE-2012-3369 is that unauthorized users could potentially gain access to the previous user's privileges through a null password.
Is CVE-2012-3369 being actively exploited?
There have been indications that CVE-2012-3369 could be targeted for exploitation due to its remote access capabilities.