Mageni Mageni Security LLC

Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

CVE-2012-3369

CVE information

Published

11 years ago

Last Modified

6 years ago

CVSSv2.0 Severity

Medium

Impact Analysis

Share

Description

The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's password to be used..

CVSSv2.0 Score

Severity
Medium
Base Score
4/10
Exploit Score
4.9/10
Access Vector
Network
Access Complexity
High
Authentication Required
None
Impact Score
4.9/10
Confidentiality Impact
Partial
Availability Impact
None
Integrity Impact
Partial

Products Affected

CPE Affected Vulnerable Excluding Edit
cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*
  Yes
- -
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0
  Yes
- -
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:
  Yes
- -

References