VIR Vulnerability Intelligence Relay

CVE-2012-4572

low
Published 2013-10-28 · Modified 2026-04-29
CVSS v3
—
CVSS v2
3.7
VIR risk
3.7

Description

Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications' authorization decisions via a crafted application.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — http://rhn.redhat.com/errata/RHSA-2013-1437.html

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — http://rhn.redhat.com/errata/RHSA-2013-0834.html

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — http://rhn.redhat.com/errata/RHSA-2013-0833.html

Application impact
VendorProductVersionsFixed
redhatjboss_enterprise_application_platform{"endIncluding":"6.0.1"}
redhatjboss_enterprise_application_platform4.2.0
redhatjboss_enterprise_application_platform4.3.0
redhatjboss_enterprise_application_platform5.0.0
redhatjboss_enterprise_application_platform5.0.1
redhatjboss_enterprise_application_platform5.1.0
redhatjboss_enterprise_application_platform5.1.1
redhatjboss_enterprise_application_platform5.1.2
redhatjboss_enterprise_application_platform5.2.0
redhatjboss_enterprise_application_platform5.2.1
redhatjboss_enterprise_application_platform5.2.2
redhatjboss_enterprise_application_platform6.0.0
redhatjboss_enterprise_portal_platform{"endIncluding":"6.0.0"}
redhatjboss_enterprise_portal_platform4.3.0
redhatjboss_enterprise_portal_platform5.0.0
redhatjboss_enterprise_portal_platform5.0.1
redhatjboss_enterprise_portal_platform5.1.0
redhatjboss_enterprise_portal_platform5.1.1
redhatjboss_enterprise_portal_platform5.2.0
redhatjboss_enterprise_portal_platform5.2.1
redhatjboss_enterprise_portal_platform5.2.2

References

CWEs

CWE-264

Verify integrity in audit chain (admin only). AS-IS.