CVE-2012-1167: redhat jboss_enterprise_application_platform
Vulnerability summary
CVE-2012-1167 is a medium (CVSS 4.6) vulnerability in redhat jboss_enterprise_application_platform. EPSS estimates a 1.60% chance of exploitation in the next 30 days, higher than 75.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 23-11-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.60%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
0.00 pp
From 1.60% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat4 products
- jboss_enterprise_application_platform5.1.0 | 5.1.1 | 5.2.0 | 5.2.1
- jboss_enterprise_brms_platform≤ 5.2.0
- jboss_enterprise_soa_platform≤ 5.2.0 | 5.0.0 | 5.0.1 | 5.0.2 | 5.1.0 | 5.1.1
- jboss_enterprise_web_platform≤ 5.1.1 | 5.1.0
1 vendor · 4 products
References
14 links- bugzilla.redhat.com/show_bug.cgi?id=802622X Refsource MISC