NetSight
IP …
high7.5

CVE-2011-4605

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.…

Impact

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

Affected products

VendorProductAffected versions
RedhatJboss Enterprise Application Platform
Versions 4.3.0, 5.1.2
RedhatJboss Enterprise Brms Platform
through 5.2.0
RedhatJboss Enterprise Portal Platform
Versions 4.3.0, 5.2.0, 5.2.1
RedhatJboss Enterprise Soa Platform
Versions 4.2.0, 4.3.0
RedhatJboss Enterprise Web Platform
Version 5.1.2

Weakness classification

CWE-264

References