high7.5
CVE-2012-1094
JBoss AS may expose root content if excluded-contexts list is mismatched
Impact
JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jboss.as:jboss-as-server | >= 7.0.0.Alpha1, < 7.1.1.Final | 7.1.1.Final |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Jboss Application Server | from 7.0.0 before 7.1.1 |