CVE-2012-3370: redhat jboss_enterprise_application_platform

EPSS trend

Probability

1.86%

Chance of exploitation in the next 30 days

Percentile

79%

Versus all other CVEs

30-day change

0.00 pp

From 1.86% on 18-09-2026

18-09-202618-10-2026

EPSS score

1.86%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

17 links

bugzilla.redhat.com/bugzilla/show_bug.cgi?id=836456X Refsource MISC
exchange.xforce.ibmcloud.com/vulnerabilities/81513VDB EntryX Refsource XF
rhn.redhat.com/errata/RHSA-2013-0192.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2013-0198.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2013-0195.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2013-0221.htmlVendor AdvisoryX Refsource REDHAT
www.osvdb.org/89581VDB EntryX Refsource OSVDB
rhn.redhat.com/errata/RHSA-2013-0196.htmlVendor AdvisoryX Refsource REDHAT
www.securityfocus.com/bid/57550VDB EntryX Refsource BID
rhn.redhat.com/errata/RHSA-2013-0193.htmlVendor AdvisoryX Refsource REDHAT

Show all 17 references

secunia.com/advisories/51984Third Party AdvisoryX Refsource SECUNIAVendor Advisory
securitytracker.com/id?1028042VDB EntryX Refsource SECTRACK
secunia.com/advisories/52054Third Party AdvisoryX Refsource SECUNIAVendor Advisory
rhn.redhat.com/errata/RHSA-2013-0191.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2013-0533.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2013-0197.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2013-0194.htmlVendor AdvisoryX Refsource REDHAT

Related vulnerabilities

CVE-2018-14642debianundertow+52.11%8y ago18-09-2018 13:00An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.CVE-2013-2165org.richfacesrichfaces+1512.66%13y ago22-07-2013 19:00ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.CVE-2013-2185apachetomcat+47.20%12y ago19-01-2014 16:00The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue CVE-2013-2133redhatenterprise_linux+11.81%12y ago06-12-2013 17:00The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.CVE-2013-2186debianlibcommons-fileupload-java+712.67%12y ago28-10-2013 21:00The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.CVE-2013-1921redhatjboss_enterprise_application_platform0.24%13y ago28-09-2013 19:00PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.

All vulnerabilities injboss_enterprise_application_platform jboss_enterprise_brms_platform jboss_enterprise_web_platform

CVE-2012-3370: redhat jboss_enterprise_application_platform

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References