CVE-2011-4608
The MITRE CVE dictionary describes this issue as:
mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.
Find out more about CVE-2011-4608 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
| Base Score | 7.5 |
|---|---|
| Base Metrics | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server | RHSA-2012:0035 | 2012-01-18 |
| Red Hat JBoss Web Platform 5 for RHEL 4 AS (mod_cluster-native) | RHSA-2012:0039 | 2012-01-18 |
| Red Hat JBoss Enterprise Application Platform 5.1 | RHSA-2012:0038 | 2012-01-18 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server | RHSA-2012:0035 | 2012-01-18 |
| Red Hat JBoss Web Platform 5.1 | RHSA-2012:0040 | 2012-01-18 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server (mod_cluster-native) | RHSA-2012:0037 | 2012-01-18 |
| Red Hat JBoss Web Platform 5 for RHEL 5 Server (mod_cluster-native) | RHSA-2012:0039 | 2012-01-18 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 AS | RHSA-2012:0035 | 2012-01-18 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server (mod_cluster-native) | RHSA-2012:0037 | 2012-01-18 |
| Red Hat JBoss Web Server 1.0 | RHSA-2012:0036 | 2012-01-18 |
| Red Hat JBoss Web Platform 5 for RHEL 6 Server (mod_cluster-native) | RHSA-2012:0039 | 2012-01-18 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS (mod_cluster-native) | RHSA-2012:0037 | 2012-01-18 |
CVE description copyright © 2017, The MITRE Corporation