CVE-2012-3370: Medium severity redhat JBoss Enterprise Application Platform vulnerability
The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remote attackers to gain privileges as other users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3370?
CVE-2012-3370 is classified as a high-severity vulnerability due to its potential for unauthorized access to user credentials.
How do I fix CVE-2012-3370?
To mitigate CVE-2012-3370, you should upgrade to JBoss Enterprise Application Platform version 5.2.0 or later.
What impact does CVE-2012-3370 have on affected software?
CVE-2012-3370 allows attackers to retrieve previous user credentials when no security context is specified, leading to potential credential leakage.
Which versions are affected by CVE-2012-3370?
CVE-2012-3370 affects JBoss EAP versions before 5.2.0, Web Platform versions before 5.2.0, and BRMS/SOA Platforms before 5.3.1.
Who is at risk from CVE-2012-3370?
Organizations using vulnerable versions of JBoss platforms are at risk of credential exposure due to CVE-2012-3370.