CVE-2014-7853
The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properly assign socket-binding-ref sensitivity classification to the security-domain attribute, which allows remote…
Does this matter?
Lower severity and a low EPSS score (1.24%). Track it; it rarely justifies an emergency change on its own.
Description
The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properly assign socket-binding-ref sensitivity classification to the security-domain attribute, which allows remote authenticated users to obtain sensitive information by leveraging access to the security-domain attribute.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
- EPSS
- 1.24% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- redhat/jboss operations network · redhat/jboss enterprise application platform
- Source
- secalert@redhat.com
References
- http://rhn.redhat.com/errata/RHSA-2015-0215.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0216.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0217.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0218.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0920.htmlVendor Advisory
- http://www.securitytracker.com/id/1031741
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100891
- http://rhn.redhat.com/errata/RHSA-2015-0215.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0216.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0217.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0218.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0920.htmlVendor Advisory
- http://www.securitytracker.com/id/1031741
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100891
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.