{"schemaVersion":3,"id":"CVE-2012-3370","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remote attackers to gain privileges as other users.","dates":{"published":"2013-02-05T23:11:00.000Z","modified":"2024-08-06T20:05:12.102Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.8,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01862,"percentile":0.78917,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.01862},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01862,"percentile":0.78917}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01862,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01862,"percentile":0.78917}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-264","name":"Permissions, Privileges, and Access Controls","description":"Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.","type":"category","status":"Obsolete","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/264.html"}],"affected":[{"vendor":"redhat","product":"jboss_enterprise_application_platform","name":"jboss enterprise application platform","label":"jboss_enterprise_application_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.2.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_application_platform"},{"vendor":"redhat","product":"jboss_enterprise_brms_platform","name":"jboss enterprise brms platform","label":"jboss_enterprise_brms_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.3.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_brms_platform"},{"vendor":"redhat","product":"jboss_enterprise_web_platform","name":"jboss enterprise web platform","label":"jboss_enterprise_web_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.2.0","eol":null,"hubHref":"/vendor/redhat/jboss_enterprise_web_platform"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=836456","label":"bugzilla.redhat.com/bugzilla/show_bug.cgi?id=836456","hostname":"bugzilla.redhat.com","tags":["X Refsource MISC"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/81513","label":"exchange.xforce.ibmcloud.com/vulnerabilities/81513","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0192.html","label":"rhn.redhat.com/errata/RHSA-2013-0192.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0198.html","label":"rhn.redhat.com/errata/RHSA-2013-0198.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0195.html","label":"rhn.redhat.com/errata/RHSA-2013-0195.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0221.html","label":"rhn.redhat.com/errata/RHSA-2013-0221.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://www.osvdb.org/89581","label":"www.osvdb.org/89581","hostname":"www.osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0196.html","label":"rhn.redhat.com/errata/RHSA-2013-0196.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://www.securityfocus.com/bid/57550","label":"www.securityfocus.com/bid/57550","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0193.html","label":"rhn.redhat.com/errata/RHSA-2013-0193.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/51984","label":"secunia.com/advisories/51984","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1028042","label":"securitytracker.com/id?1028042","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://secunia.com/advisories/52054","label":"secunia.com/advisories/52054","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0191.html","label":"rhn.redhat.com/errata/RHSA-2013-0191.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0533.html","label":"rhn.redhat.com/errata/RHSA-2013-0533.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0197.html","label":"rhn.redhat.com/errata/RHSA-2013-0197.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0194.html","label":"rhn.redhat.com/errata/RHSA-2013-0194.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]}],"lineage":{"upstream":[],"downstream":["RHSA-2013:0191","RHSA-2013:0192","RHSA-2013:0193","RHSA-2013:0195","RHSA-2013:0196","RHSA-2013:0197"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2013-02-05T23:11:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T20:05:12.102Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":24,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T05:30:19.177Z","stale":false,"partial":false}}