CVE-2013-4112: Infoleak
A flaw was found in JGroup's DiagnosticsHandler that allowed an attacker on an adjacent network to reuse the credentials from a previous successful authentication. This could be exploited to read diagnostic information (information disclosure) and attain limited remote code execution.
This issue affects JGroups versions 3.0.x (3.0.11.Final and later), 3.1.x (3.1.0.Final and later), 3.2.x (prior to 3.2.10.Final) and 3.3.x (prior to 3.3.3.Final).
Other sources
The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4112?
CVE-2013-4112 has a moderate severity rating, indicating significant risk to affected systems.
How do I fix CVE-2013-4112?
To remediate CVE-2013-4112, upgrade to JGroups version 3.3.2 or later, which resolves the credential reuse vulnerability.
Which versions of JGroups are affected by CVE-2013-4112?
CVE-2013-4112 impacts JGroups versions 3.0.0 to 3.3.1.
What potential impact does CVE-2013-4112 have on my system?
Exploitation of CVE-2013-4112 can lead to information disclosure and limited remote code execution.
Is there a workaround for CVE-2013-4112 if I can't upgrade?
There are no effective workarounds for CVE-2013-4112; upgrading to a secure version is the best solution.