{"schemaVersion":3,"id":"CVE-2011-4085","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method.  NOTE: this vulnerability exists because of a CVE-2010-0738 regression.","dates":{"published":"2012-11-23T20:00:00.000Z","modified":"2024-08-06T23:53:32.785Z","reserved":null,"kevAdded":["2025-07-14T00:00:00.000Z"],"kevDue":[]},"cvss":{"headline":{"score":6.8,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0294,"percentile":0.86907,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.0294},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0294,"percentile":0.86907}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0294,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0294,"percentile":0.86907}]},"kev":{"state":"listed","entries":[{"source":"enisa","sourceLabel":"ENISA","dateAdded":"2025-07-14T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":"Some management interfaces remain accessible and lack effective access control mechanisms","notes":[{"type":"url","href":"https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note","label":"www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note"}],"vendor":"Red Hat","product":"JBoss Application Server","ransomware":false,"ransomwareUse":null,"exploitationType":"unknown"}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":true,"entry":{"source":"enisa","sourceLabel":"ENISA","dateAdded":"2025-07-14T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":"Some management interfaces remain accessible and lack effective access control mechanisms","notes":[{"type":"url","href":"https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note","label":"www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note"}],"vendor":"Red Hat","product":"JBoss Application Server","ransomware":false,"ransomwareUse":null,"exploitationType":"unknown"}},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-287","name":"Improper Authentication","description":"When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/287.html"}],"affected":[{"vendor":"redhat","product":"jboss_enterprise_application_platform","name":"jboss enterprise application platform","label":"jboss_enterprise_application_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.1.1","noFixRecorded":false,"fixedIn":null},{"text":"4.2.0","noFixRecorded":false,"fixedIn":null},{"text":"4.3.0","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0","noFixRecorded":false,"fixedIn":null},{"text":"5.0.1","noFixRecorded":false,"fixedIn":null},{"text":"5.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.1.1 | 4.2.0 | 4.3.0 | 5.0.0 | 5.0.1 | 5.1.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_application_platform"},{"vendor":"redhat","product":"jboss_enterprise_brms_platform","name":"jboss enterprise brms platform","label":"jboss_enterprise_brms_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.2.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_brms_platform"},{"vendor":"redhat","product":"jboss_enterprise_portal_platform","name":"jboss enterprise portal platform","label":"jboss_enterprise_portal_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 4.3.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_portal_platform"},{"vendor":"redhat","product":"jboss_enterprise_soa_platform","name":"jboss enterprise soa platform","label":"jboss_enterprise_soa_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.1.1","noFixRecorded":false,"fixedIn":null},{"text":"4.2.0","noFixRecorded":false,"fixedIn":null},{"text":"4.2.0:cp01","noFixRecorded":false,"fixedIn":null},{"text":"4.2.0:cp02","noFixRecorded":false,"fixedIn":null},{"text":"4.2.0:cp03","noFixRecorded":false,"fixedIn":null},{"text":"4.2.0:cp04","noFixRecorded":false,"fixedIn":null},{"text":"4.2.0:cp05","noFixRecorded":false,"fixedIn":null},{"text":"4.2.0:tp02","noFixRecorded":false,"fixedIn":null},{"text":"4.3.0","noFixRecorded":false,"fixedIn":null},{"text":"4.3.0:cp01","noFixRecorded":false,"fixedIn":null},{"text":"4.3.0:cp02","noFixRecorded":false,"fixedIn":null},{"text":"4.3.0:cp03","noFixRecorded":false,"fixedIn":null},{"text":"4.3.0:cp04","noFixRecorded":false,"fixedIn":null},{"text":"4.3.0:cp05","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0","noFixRecorded":false,"fixedIn":null},{"text":"5.0.1","noFixRecorded":false,"fixedIn":null},{"text":"5.0.2","noFixRecorded":false,"fixedIn":null},{"text":"5.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.1.1 | 4.2.0 | 4.2.0:cp01 | 4.2.0:cp02 | 4.2.0:cp03 | 4.2.0:cp04 | 4.2.0:cp05 | 4.2.0:tp02 | 4.3.0 | 4.3.0:cp01 | 4.3.0:cp02 | 4.3.0:cp03 | 4.3.0:cp04 | 4.3.0:cp05 | 5.0.0 | 5.0.1 | 5.0.2 | 5.1.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_soa_platform"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2012-1028.html","label":"rhn.redhat.com/errata/RHSA-2012-1028.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/47866","label":"secunia.com/advisories/47866","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2011-1805.html","label":"rhn.redhat.com/errata/RHSA-2011-1805.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2011-1456.html","label":"rhn.redhat.com/errata/RHSA-2011-1456.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0091.html","label":"rhn.redhat.com/errata/RHSA-2012-0091.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2011-1822.html","label":"rhn.redhat.com/errata/RHSA-2011-1822.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2011-1799.html","label":"rhn.redhat.com/errata/RHSA-2011-1799.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=750422","label":"bugzilla.redhat.com/show_bug.cgi?id=750422","hostname":"bugzilla.redhat.com","tags":["X Refsource MISC"]},{"url":"http://rhn.redhat.com/errata/RHSA-2011-1798.html","label":"rhn.redhat.com/errata/RHSA-2011-1798.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2011-1800.html","label":"rhn.redhat.com/errata/RHSA-2011-1800.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/47169","label":"secunia.com/advisories/47169","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":["RHSA-2011:1798","RHSA-2011:1799","RHSA-2011:1800"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2012-11-23T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T23:53:32.785Z","label":"Last modified","detail":"Vulnerability information updated.","source":null},{"kind":"kev-added","date":"2025-07-14T00:00:00.000Z","label":"Added to ENISA KEV","detail":"Added to the ENISA known exploited vulnerabilities catalog.","source":"enisa"}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T10:59:06.072Z","stale":false,"partial":false}}