SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2012-1154

mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access…

MEDIUM 4.3EPSS 2.59%

Does this matter?

Lower severity and a low EPSS score (2.59%). Track it; it rarely justifies an emergency change on its own.

Description

mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.

CVSS 2.0
4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
EPSS
2.59% probability · 84th percentile
CISA KEV
Not listed
Weakness
CWE-264
Affected
redhat/jboss enterprise application platform · redhat/mod cluster
Source
secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.