{"schemaVersion":3,"id":"CVE-2012-0874","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors.  NOTE: this issue can only be exploited when the interceptor is not properly configured with a \"second layer of authentication,\" or when used in conjunction with other vulnerabilities that bypass this second layer.","dates":{"published":"2013-02-05T23:11:00.000Z","modified":"2024-08-06T18:38:14.958Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.8,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.15561,"percentile":0.96799,"severity":"medium","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.15561},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.15561,"percentile":0.96799}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.15561,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.15561,"percentile":0.96799}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"30211","name":"EMC Data Protection Advisor DPA Illuminator - EJBInvokerServlet Remote Code Execution","source":"exploit-database","url":"https://www.exploit-db.com/exploits/30211","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"windows","file":"exploits/windows/remote/30211.txt","codes":["CVE-2012-0874"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-287","name":"Improper Authentication","description":"When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/287.html"}],"affected":[{"vendor":"redhat","product":"jboss_enterprise_application_platform","name":"jboss enterprise application platform","label":"jboss_enterprise_application_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.2.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_application_platform"},{"vendor":"redhat","product":"jboss_enterprise_brms_platform","name":"jboss enterprise brms platform","label":"jboss_enterprise_brms_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.3.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_brms_platform"},{"vendor":"redhat","product":"jboss_enterprise_web_platform","name":"jboss enterprise web platform","label":"jboss_enterprise_web_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.2.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_web_platform"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-0192.html","label":"rhn.redhat.com/errata/RHSA-2013-0192.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0198.html","label":"rhn.redhat.com/errata/RHSA-2013-0198.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0195.html","label":"rhn.redhat.com/errata/RHSA-2013-0195.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0221.html","label":"rhn.redhat.com/errata/RHSA-2013-0221.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0196.html","label":"rhn.redhat.com/errata/RHSA-2013-0196.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://www.securityfocus.com/bid/57552","label":"www.securityfocus.com/bid/57552","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0193.html","label":"rhn.redhat.com/errata/RHSA-2013-0193.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/51984","label":"secunia.com/advisories/51984","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1028042","label":"securitytracker.com/id?1028042","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://secunia.com/advisories/52054","label":"secunia.com/advisories/52054","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-12/0134.html","label":"archives.neohapsis.com/archives/bugtraq/2013-12/0134.html","hostname":"archives.neohapsis.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0191.html","label":"rhn.redhat.com/errata/RHSA-2013-0191.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=795645","label":"bugzilla.redhat.com/show_bug.cgi?id=795645","hostname":"bugzilla.redhat.com","tags":["X Refsource MISC"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0533.html","label":"rhn.redhat.com/errata/RHSA-2013-0533.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0197.html","label":"rhn.redhat.com/errata/RHSA-2013-0197.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://www.exploit-db.com/exploits/30211","label":"www.exploit-db.com/exploits/30211","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/81511","label":"exchange.xforce.ibmcloud.com/vulnerabilities/81511","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0194.html","label":"rhn.redhat.com/errata/RHSA-2013-0194.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]}],"lineage":{"upstream":[],"downstream":["RHSA-2013:0191","RHSA-2013:0192","RHSA-2013:0193","RHSA-2013:0195","RHSA-2013:0196","RHSA-2013:0197"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2013-02-05T23:11:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T18:38:14.958Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:30:53.729Z","stale":false,"partial":false}}