Is CVE-2012-0874 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 16%.

What products does CVE-2012-0874 affect?

Tracked products affected include JBoss. Check the version you run to see whether it is affected.

How do I fix CVE-2012-0874?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2012-0874

Q: What is CVE-2012-0874?

CVE-2012-0874 is a medium-severity software vulnerability (Improper authentication) with a CVSS score of 6.8. The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require

MEDIUM severity · CVSS 6.8 · Improper authentication

6.8CVSS MEDIUM

Summary

The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.

Impact & exploitability

Attack vectorNetwork

Attack complexity—

Privileges required—

User interaction—

Confidentiality impact—

Integrity impact—

Availability impact—

Exploit probability (EPSS)16%

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products we track (1)

JBoss

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

CVE-2012-0874

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information