CVE-2011-4085

Description

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.

Risk Information

Base Score

5.0

MODERATE

Vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS Score

Exploitation Probability

0.719

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 5.0.0	Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 4.3.0	Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 5.1.0	Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 4.2.0	Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 5.1.1	Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 5.0.1	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234