NetSight
IP …
medium4.0

CVE-2012-3369

The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA…

Impact

The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's password to be used.

Affected products

VendorProductAffected versions
RedhatJboss Enterprise Web Platform
Version 5.2.0
RedhatJboss Enterprise Application Platform
Version 5.2.0
RedhatJboss Enterprise Brms Platform
through 5.3.0

Weakness classification

CWE-264

References