CVE-2012-4572: Low severity jboss enterprise application platform vulnerability
If multiple applications use the same custom authorization module class name, and provide their own implementations of it, the first application to be loaded will have its implementation used for all applications using the same custom authorization module class name. A local attacker could use this flaw to deploy a malicious application that provides implementations of custom authorization modules that permit or deny user access according to rules supplied by the attacker.
Other sources
Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications' authorization decisions via a crafted application.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4572?
The severity of CVE-2012-4572 is considered to be moderate.
How do I fix CVE-2012-4572?
To fix CVE-2012-4572, ensure that each application uses a unique custom authorization module class name or update to a version that addresses this vulnerability.
What applications are affected by CVE-2012-4572?
CVE-2012-4572 affects various versions of Red Hat JBoss Enterprise Application Platform and JBoss Enterprise Portal Platform.
Is CVE-2012-4572 exploitable by remote attackers?
CVE-2012-4572 is considered a local vulnerability and is not directly exploitable by remote attackers.
What impact does CVE-2012-4572 have on affected systems?
CVE-2012-4572 may lead to unauthorized access or execution of custom authorization code across multiple applications using the same class name.