CVE-2014-0245: Race Condition
It was found that the implementation of GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it is possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer and the endpoint in question is being used by a privileged user.
Other sources
It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer, and the endpoint in question is being used by a privileged user. This affects JBoss Portal 6.2.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0245?
CVE-2014-0245 is classified as a medium severity vulnerability, potentially allowing unauthorized access under specific conditions.
How do I fix CVE-2014-0245?
To mitigate CVE-2014-0245, update the affected gatein-wsrp package to a version that addresses the thread safety issues.
What software is affected by CVE-2014-0245?
CVE-2014-0245 affects Red Hat's gatein-wsrp version 2.3.1.Final-prod and JBoss Portal version 6.2.0.
Can CVE-2014-0245 be exploited remotely?
Yes, CVE-2014-0245 can be exploited by unauthenticated remote attackers in high-concurrency environments.
What is the impact of CVE-2014-0245 on security?
The impact of CVE-2014-0245 includes the potential for privilege escalation and unauthorized actions on the affected system.