Authorization Bypass

2019-01-1509:11:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.007 Low

EPSS

Percentile

79.5%

JSON

JGroup is vulnerable to aurthorization bypass attacks which can lead to information disclosure and spoofing attacks. The vulnerability exists as a malicious user can bypass security restrictions when the attacker node joins the cluster. It happens as JGroup did not check for the essential headers for encrypt and auth protocols when a new node joins the cluster.

CPENameOperatorVersion
eap7-jgroupseq3.6.8__2.Final_redhat_2.1.ep7.el6
eap7-jgroupseq3.6.8__2.Final_redhat_2.1.ep7.el7
jgroupseq2.6.20__1.1.ep5.el6
jgroupseq3.0.14__2.Final_redhat_1.ep6.el6
jgroupseq3.2.15__1.Final_redhat_1.1.ep6.el6
jgroupseq3.2.13__1.Final_redhat_1.1.ep6.el5
jgroupseq3.2.10__1.Final_redhat_2.2.ep6.el5
jgroupseq2.4.1__1.SP4.0jpp.ep1.2.el5
jgroupseq2.6.22__1.ep5.el4
jgroupseq3.0.9__1.Final_redhat_1.ep6.el5

Name	Operator	Version
eap7-jgroups	eq	3.6.8__2.Final_redhat_2.1.ep7.el6
eap7-jgroups	eq	3.6.8__2.Final_redhat_2.1.ep7.el7
jgroups	eq	2.6.20__1.1.ep5.el6
jgroups	eq	3.0.14__2.Final_redhat_1.ep6.el6
jgroups	eq	3.2.15__1.Final_redhat_1.1.ep6.el6
jgroups	eq	3.2.13__1.Final_redhat_1.1.ep6.el5
jgroups	eq	3.2.10__1.Final_redhat_2.2.ep6.el5
jgroups	eq	2.4.1__1.SP4.0jpp.ep1.2.el5
jgroups	eq	2.6.22__1.ep5.el4
jgroups	eq	3.0.9__1.Final_redhat_1.ep6.el5