CVE-2009-0027

2009-03-0921:30:00

CWE-20

[email protected]

web.nvd.nist.gov

jboss

jbossws

jboss eap

cve-2009-0027

security vulnerability

xml file

remote attack

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.5 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

75.3%

JSON

The request handler in JBossWS in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read arbitrary XML files via a crafted request.

Affected configurations

NVD

Node

redhatjboss_enterprise_application_platformMatch4.2.0cp01

redhatjboss_enterprise_application_platformMatch4.2.0cp02

redhatjboss_enterprise_application_platformMatch4.2.0cp03

redhatjboss_enterprise_application_platformMatch4.2.0cp04

redhatjboss_enterprise_application_platformMatch4.2.0cp05

redhatjboss_enterprise_application_platformMatch4.2.0cp06

redhatjboss_enterprise_application_platformMatch4.3.0cp01

redhatjboss_enterprise_application_platformMatch4.3.0cp02

redhatjboss_enterprise_application_platformMatch4.3.0cp03

redhatjboss_enterprise_application_platformMatch4.3.0cp04

CPENameOperatorVersion
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq4.2.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq4.3.0

CPE	Name	Operator	Version
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	4.2.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	4.3.0