VulnerabilityModified
CVE-2012-1100
Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based accounts via an arbitrary password in a…
MEDIUM 5.8EPSS 1.24%
Does this matter?
Lower severity and a low EPSS score (1.24%). Track it; it rarely justifies an emergency change on its own.
Description
Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based accounts via an arbitrary password in a login request.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 1.24% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- redhat/jboss operations network
- Source
- secalert@redhat.com
References
- http://rhn.redhat.com/errata/RHSA-2012-0396.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0406.htmlVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=799789
- http://rhn.redhat.com/errata/RHSA-2012-0396.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0406.htmlVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=799789
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.