CVE-2011-4605: redhat jboss_enterprise_application_platform

EPSS trend

Probability

3.52%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

0.00 pp

From 3.52% on 18-09-2026

18-09-202618-10-2026

EPSS score

3.52%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

25 links

www.securitytracker.com/id?1027501VDB EntryX Refsource SECTRACK
secunia.com/advisories/49656Third Party AdvisoryX Refsource SECUNIAVendor Advisory
rhn.redhat.com/errata/RHSA-2012-1028.htmlVendor AdvisoryX Refsource REDHAT
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=766469X Refsource MISC
secunia.com/advisories/49658Third Party AdvisoryX Refsource SECUNIAVendor Advisory
rhn.redhat.com/errata/RHSA-2012-1109.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2012-1025.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/50084Third Party AdvisoryX Refsource SECUNIAVendor Advisory
rhn.redhat.com/errata/RHSA-2012-1295.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2012-1027.htmlVendor AdvisoryX Refsource REDHAT

Show all 25 references

www.securityfocus.com/bid/54644VDB EntryX Refsource BID
rhn.redhat.com/errata/RHSA-2012-1026.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/50549Third Party AdvisoryX Refsource SECUNIAVendor Advisory
rhn.redhat.com/errata/RHSA-2012-1024.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2012-1232.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2012-1022.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2012-1023.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2012-1125.htmlVendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2012:1025Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=766469REPORT
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1025.jsonAdvisory
access.redhat.com/security/cve/CVE-2011-4605REPORT
www.cve.org/CVERecord?id=CVE-2011-4605Advisory
nvd.nist.gov/vuln/detail/CVE-2011-4605Advisory

Related vulnerabilities

CVE-2018-14642debianundertow+52.11%8y ago18-09-2018 13:00An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.CVE-2013-2165org.richfacesrichfaces+1512.66%13y ago22-07-2013 19:00ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.CVE-2013-2102redhatjboss_enterprise_portal_platform0.98%12y ago28-10-2013 21:00The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive information (diagnostics) by accessing the service.CVE-2013-2185apachetomcat+47.20%12y ago19-01-2014 16:00The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue CVE-2013-2133redhatenterprise_linux+11.81%12y ago06-12-2013 17:00The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.CVE-2013-2186debianlibcommons-fileupload-java+712.67%12y ago28-10-2013 21:00The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

All vulnerabilities injboss_enterprise_application_platform jboss_enterprise_brms_platform jboss_enterprise_portal_platform jboss_enterprise_soa_platform jboss_enterprise_web_platform

CVE-2011-4605: redhat jboss_enterprise_application_platform

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References