NetSight
IP …
medium5.8

CVE-2012-3370

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before…

Impact

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remote attackers to gain privileges as other users.

Affected products

VendorProductAffected versions
RedhatJboss Enterprise Application Platform
Version 5.2.0
RedhatJboss Enterprise Web Platform
Version 5.2.0
RedhatJboss Enterprise Brms Platform
through 5.3.0

Weakness classification

CWE-264

References