CVE-2011-4085

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal…

published November 23, 2012

CVSS
—
EPSS
3%
Percentile
86.9
In the wild
Unconfirmed
What it is

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02940 · 86.9th percentile
Published
2012-11-23T20:00Z
EPSS history
Timeline
  • 23 NOV 20:00Z
    The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal…
    cvelistv5