Unauthorized Modification

2019-01-1508:53:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.016 Low

EPSS

Percentile

87.7%

JSON

jbossas is vulnerable to unauthorized modification attacks. The vulnerability exists in the (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

CPENameOperatorVersion
jbossaseq4.2.0__6.GA_CP09.11.1.ep1.el5
jbossaseq5.1.1__16.ep5.el5
jbossaseq4.0.4__1.el4s1.20
jbossaseq5.1.2__8.ep5.el4
jbossaseq4.3.0__10.GA_CP10_patch_01.1.ep1.el4
jbossaseq5.1.1__17.ep5.el6
jbossaseq4.2.0__6.GA_CP09.11.ep1.el4
jbossaseq4.2.0__4.GA_CP02.ep1.3.el5.3
jbossaseq4.0.5__1.el4s1.5
jbossaseq4.0.4__1.el4s1.25

Name	Operator	Version
jbossas	eq	4.2.0__6.GA_CP09.11.1.ep1.el5
jbossas	eq	5.1.1__16.ep5.el5
jbossas	eq	4.0.4__1.el4s1.20
jbossas	eq	5.1.2__8.ep5.el4
jbossas	eq	4.3.0__10.GA_CP10_patch_01.1.ep1.el4
jbossas	eq	5.1.1__17.ep5.el6
jbossas	eq	4.2.0__6.GA_CP09.11.ep1.el4
jbossas	eq	4.2.0__4.GA_CP02.ep1.3.el5.3
jbossas	eq	4.0.5__1.el4s1.5
jbossas	eq	4.0.4__1.el4s1.25