Design/Logic Flaw

2012-11-2320:55:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.8%

JSON

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast.

CPENameOperatorVersion
jboss_enterprise_brms_platformle5.2.0
jboss_enterprise_portal_platformeq5.0.0
jboss_enterprise_portal_platformeq5.1.1
jboss_enterprise_portal_platformeq5.1.0
jboss_enterprise_portal_platformeq4.3.0 cp7
jboss_enterprise_portal_platformle5.2.1
jboss_enterprise_portal_platformeq4.3.0
jboss_enterprise_portal_platformeq5.2.0
jboss_enterprise_portal_platformeq5.0.1
jboss_enterprise_soa_platformeq4.3.0

Name	Operator	Version
jboss_enterprise_brms_platform	le	5.2.0
jboss_enterprise_portal_platform	eq	5.0.0
jboss_enterprise_portal_platform	eq	5.1.1
jboss_enterprise_portal_platform	eq	5.1.0
jboss_enterprise_portal_platform	eq	4.3.0 cp7
jboss_enterprise_portal_platform	le	5.2.1
jboss_enterprise_portal_platform	eq	4.3.0
jboss_enterprise_portal_platform	eq	5.2.0
jboss_enterprise_portal_platform	eq	5.0.1
jboss_enterprise_soa_platform	eq	4.3.0