Question 1

What is CVE-2013-4112?

Accepted Answer

CVE-2013-4112 is a medium-severity software vulnerability (Information disclosure) with a CVSS score of 5.4. The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.

Question 2

Is CVE-2013-4112 being actively exploited?

Accepted Answer

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 2%.

Question 3

What products does CVE-2013-4112 affect?

Accepted Answer

Tracked products affected include JBoss. Check the version you run to see whether it is affected.

Question 4

How do I fix CVE-2013-4112?

Accepted Answer

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2013-4112

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information