{"schemaVersion":3,"id":"CVE-2012-1167","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.","dates":{"published":"2012-11-23T20:00:00.000Z","modified":"2024-08-06T18:53:35.669Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.6,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:H/Au:S/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.6,"severity":"medium","vector":"AV:N/AC:H/Au:S/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01604,"percentile":0.75442,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.01604},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01604,"percentile":0.75442}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01604,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01604,"percentile":0.75442}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-264","name":"Permissions, Privileges, and Access Controls","description":"Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.","type":"category","status":"Obsolete","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/264.html"}],"affected":[{"vendor":"redhat","product":"jboss_enterprise_application_platform","name":"jboss enterprise application platform","label":"jboss_enterprise_application_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.1.0","noFixRecorded":false,"fixedIn":null},{"text":"5.1.1","noFixRecorded":false,"fixedIn":null},{"text":"5.2.0","noFixRecorded":false,"fixedIn":null},{"text":"5.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.1.0 | 5.1.1 | 5.2.0 | 5.2.1","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_application_platform"},{"vendor":"redhat","product":"jboss_enterprise_brms_platform","name":"jboss enterprise brms platform","label":"jboss_enterprise_brms_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.2.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_brms_platform"},{"vendor":"redhat","product":"jboss_enterprise_soa_platform","name":"jboss enterprise soa platform","label":"jboss_enterprise_soa_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.2.0","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0","noFixRecorded":false,"fixedIn":null},{"text":"5.0.1","noFixRecorded":false,"fixedIn":null},{"text":"5.0.2","noFixRecorded":false,"fixedIn":null},{"text":"5.1.0","noFixRecorded":false,"fixedIn":null},{"text":"5.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.2.0 | 5.0.0 | 5.0.1 | 5.0.2 | 5.1.0 | 5.1.1","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_soa_platform"},{"vendor":"redhat","product":"jboss_enterprise_web_platform","name":"jboss enterprise web platform","label":"jboss_enterprise_web_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.1.1","noFixRecorded":false,"fixedIn":null},{"text":"5.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.1.1 | 5.1.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_web_platform"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=802622","label":"bugzilla.redhat.com/show_bug.cgi?id=802622","hostname":"bugzilla.redhat.com","tags":["X Refsource MISC"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1028.html","label":"rhn.redhat.com/errata/RHSA-2012-1028.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/49658","label":"secunia.com/advisories/49658","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/49635","label":"secunia.com/advisories/49635","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1027.html","label":"rhn.redhat.com/errata/RHSA-2012-1027.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1013.html","label":"rhn.redhat.com/errata/RHSA-2012-1013.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/76680","label":"exchange.xforce.ibmcloud.com/vulnerabilities/76680","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1026.html","label":"rhn.redhat.com/errata/RHSA-2012-1026.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/50549","label":"secunia.com/advisories/50549","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1014.html","label":"rhn.redhat.com/errata/RHSA-2012-1014.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://www.securityfocus.com/bid/54089","label":"www.securityfocus.com/bid/54089","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://securitytracker.com/id?1027501","label":"securitytracker.com/id?1027501","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1232.html","label":"rhn.redhat.com/errata/RHSA-2012-1232.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1125.html","label":"rhn.redhat.com/errata/RHSA-2012-1125.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]}],"lineage":{"upstream":[],"downstream":["RHSA-2012:1026","RHSA-2012:1027"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2012-11-23T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T18:53:35.669Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":19,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T05:34:18.992Z","stale":false,"partial":false}}