CVE-2007-1354: jboss jboss_application_server
Vulnerability summary
CVE-2007-1354 is a medium (CVSS 6.0) vulnerability in jboss jboss_application_server. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 73.7% of scored vulnerabilities.
Timeline
- 27-07-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by logging in during a session by a more privileged administrator, as demonstrated by privilege escalation from Read Mode to Write Mode.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.49%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.49% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Jboss1 product
- jboss_application_server4.0.2.ga_cp02 | 4.0.2.ga_cp03 | 4.0.2.ga_cp04 | 4.0.5.ga | 4.0.5_cp01 | 4.0.5_cp02
1 vendor · 1 product