CVE-2014-0005: Low severity jboss enterprise application platform vulnerability
IssueDescription:
It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.
Other sources
PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever configuration and state by deploying a crafted application.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0005?
CVE-2014-0005 is classified as a high-severity vulnerability due to the potential for unauthorized access to server configurations.
How do I fix CVE-2014-0005?
To fix CVE-2014-0005, apply the necessary patches provided by Red Hat for affected versions of JBoss Enterprise Application Platform and JBoss BRMS Platform.
Which versions of software are affected by CVE-2014-0005?
CVE-2014-0005 affects Red Hat JBoss Enterprise Application Platform version 6.2.2 and JBoss Enterprise BRMS Platform versions up to 6.0.3.
What types of attacks can exploit CVE-2014-0005?
CVE-2014-0005 can be exploited to allow unauthorized applications to read or alter the application server's configuration.
Is CVE-2014-0005 a remote vulnerability?
Yes, CVE-2014-0005 is a remote vulnerability that can be exploited by an attacker with the ability to deploy applications on the server.