Red Hat Customer Portal

Skip to main content

CVE-2012-3369

Impact:
Low
Public Date:
2013-01-24
Bugzilla:
836451: CVE-2012-3369 JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided

The MITRE CVE dictionary describes this issue as:

The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's password to be used.

Find out more about CVE-2012-3369 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.

Base Score 4
Base Metrics AV:N/AC:H/Au:N/C:P/I:P/A:N
Access Vector Network
Access Complexity High
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat JBoss Enterprise Application Platform 5.2 RHSA-2013:0194 2013-01-24
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server (xml-security) RHSA-2013:0191 2013-01-24
Red Hat JBoss Web Platform 5.2 RHSA-2013:0198 2013-01-24
Red Hat JBoss SOA Platform 5.3 RHSA-2013:0533 2013-02-20
JBoss Enterprise BRMS Platform 5.3 RHSA-2013:0221 2013-01-31
Red Hat JBoss Web Platform 5 for RHEL 6 Server (xml-security) RHSA-2013:0195 2013-01-24
Red Hat JBoss Web Platform 5 for RHEL 5 Server (xml-security) RHSA-2013:0196 2013-01-24
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS (xml-security) RHSA-2013:0193 2013-01-24
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server (xml-security) RHSA-2013:0192 2013-01-24
Red Hat JBoss Web Platform 5 for RHEL 4 AS (xml-security) RHSA-2013:0197 2013-01-24

Acknowledgements

This issue was discovered by Carlo de Wolf of Red Hat.

Last Modified