CVE Vulnerabilities

CVE-2011-4085

Improper Authentication

Published: Nov 23, 2012 | Modified: Apr 11, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
2.6 LOW
AV:N/AC:H/Au:N/C:N/I:N/A:P
RedHat/V3
Ubuntu
root.io logo minimus.io logo echo.ai logo

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

NameVendorStart VersionEnd Version
Jboss_enterprise_application_platformRedhat*5.1.1 (including)
Jboss_enterprise_application_platformRedhat4.2.0 (including)4.2.0 (including)
Jboss_enterprise_application_platformRedhat4.3.0 (including)4.3.0 (including)
Jboss_enterprise_application_platformRedhat5.0.0 (including)5.0.0 (including)
Jboss_enterprise_application_platformRedhat5.0.1 (including)5.0.1 (including)
Jboss_enterprise_application_platformRedhat5.1.0 (including)5.1.0 (including)
JBoss Enterprise BRMS Platform 5.3RedHat*
Red Hat JBoss Enterprise Application Platform 5.1RedHat*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatapache-cxf-0:2.2.12-4.patch_02.1.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatcglib-0:2.2-5.3.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatfacelets-0:1.1.15-3.B1_patch_01.2.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatglassfish-jaxb-0:2.1.12-10_patch_02.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatglassfish-jsf-0:1.2_13-5_patch_01.3.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjacorb-jboss-0:2.3.1-10.patch_03.4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjakarta-commons-logging-jboss-0:1.1-10.3_patch_02.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-aop2-0:2.1.6-2.CP03.1.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjbossas-0:5.1.2-8.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjbossas-tp-licenses-0:5.1.2-7.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjbossas-ws-cxf-0:5.1.2-8.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-cache-core-0:3.2.8-1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-cl-0:2.0.10-1.2.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-cluster-ha-client-0:1.1.4-1.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-common-core-0:2.2.18-1.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-eap5-native-0:5.1.2-1.4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-ejb3-core-0:1.3.8-0.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-ejb3-proxy-clustered-0:1.0.3-2.SP1.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-ejb3-proxy-impl-0:1.0.6-2.SP2.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-el-0:1.0_02-0.CR6.2.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-messaging-0:1.4.8-9.SP5.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-naming-0:5.0.3-3.CP01.3.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-remoting-0:2.5.4-9.SP3.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-seam2-0:2.2.5.EAP5-6.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjboss-security-spi-1:2.0.4-6.SP8.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjbosssx2-0:2.0.4-6.SP8.2.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjbossts-1:4.6.1-11.CP12.4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjbossweb-0:2.1.12-1.4_patch_01.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjbossws-0:3.1.2-7.SP11.4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjbossws-common-0:1.1.0-6.SP8_patch_01.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjbossws-framework-0:3.1.2-6.SP10.2.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjbossws-spi-0:1.1.2-5.SP7.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjgroups-1:2.6.20-1.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjopr-embedded-0:1.3.4-18.SP5.8.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjopr-hibernate-plugin-0:3.0.0-14.EmbJopr4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjopr-jboss-as-5-plugin-0:3.0.0-13.EmbJopr4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatjopr-jboss-cache-v3-plugin-0:3.0.0-14.EmbJopr4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatmod_cluster-0:1.0.10-3.GA_CP02.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatmod_cluster-native-0:1.0.10-3.GA_CP02.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatorg-mc4j-ems-0:1.2.15.1-4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatpicketlink-federation-0:2.0.2-1.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatresteasy-0:1.2.1-9.CP02.4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatrh-eap-docs-0:5.1.2-6.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatrhq-0:3.0.0-21.EmbJopr4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatrhq-jmx-plugin-0:3.0.0-21.EmbJopr4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatrhq-platform-plugin-0:3.0.0-14.EmbJopr4.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatslf4j-0:1.5.8-10_patch_01.2.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4RedHatxalan-j2-0:2.7.1-6_patch_05.1.ep5.el4*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatapache-cxf-0:2.2.12-4.patch_02.1.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatcglib-0:2.2-5.3.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatfacelets-0:1.1.15-3.B1_patch_01.2.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatglassfish-jaxb-0:2.1.12-10_patch_02.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatglassfish-jsf-0:1.2_13-5_patch_01.3.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjacorb-jboss-0:2.3.1-10.patch_03.4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjakarta-commons-logging-jboss-0:1.1-10.3_patch_02.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-aop2-0:2.1.6-2.CP03.1.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjbossas-0:5.1.2-8.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjbossas-tp-licenses-0:5.1.2-7.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjbossas-ws-cxf-0:5.1.2-8.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-cache-core-0:3.2.8-1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-cl-0:2.0.10-1.2.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-cluster-ha-client-0:1.1.4-1.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-common-core-0:2.2.18-1.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-eap5-native-0:5.1.2-1.4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-ejb3-core-0:1.3.8-0.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-ejb3-proxy-clustered-0:1.0.3-2.SP1.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-ejb3-proxy-impl-0:1.0.6-2.SP2.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-el-0:1.0_02-0.CR6.2.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-messaging-0:1.4.8-9.SP5.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-naming-0:5.0.3-3.CP01.3.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-remoting-0:2.5.4-9.SP3.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-seam2-0:2.2.5.EAP5-5.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjboss-security-spi-1:2.0.4-6.SP8.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjbosssx2-0:2.0.4-6.SP8.2.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjbossts-1:4.6.1-11.CP12.4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjbossweb-0:2.1.12-1.4_patch_01.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjbossws-0:3.1.2-7.SP11.4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjbossws-common-0:1.1.0-6.SP8_patch_01.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjbossws-framework-0:3.1.2-6.SP10.2.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjbossws-spi-0:1.1.2-5.SP7.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjgroups-1:2.6.20-1.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjopr-embedded-0:1.3.4-18.SP5.8.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjopr-hibernate-plugin-0:3.0.0-13.EmbJopr4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjopr-jboss-as-5-plugin-0:3.0.0-12.EmbJopr4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatjopr-jboss-cache-v3-plugin-0:3.0.0-14.EmbJopr4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatmod_cluster-0:1.0.10-3.1.GA_CP02.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatmod_cluster-native-0:1.0.10-3.1.GA_CP02.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatorg-mc4j-ems-0:1.2.15.1-4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatpicketlink-federation-0:2.0.2-1.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatresteasy-0:1.2.1-9.CP02.4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatrh-eap-docs-0:5.1.2-6.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatrhq-0:3.0.0-20.EmbJopr4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatrhq-jmx-plugin-0:3.0.0-20.EmbJopr4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatrhq-platform-plugin-0:3.0.0-13.EmbJopr4.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatslf4j-0:1.5.8-10_patch_01.2.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5RedHatxalan-j2-0:2.7.1-6_patch_05.1.ep5.el5*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatapache-cxf-0:2.2.12-4.patch_02.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatcglib-0:2.2-5.5.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatfacelets-0:1.1.15-3.B1_patch_01.2.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatglassfish-jaxb-0:2.1.12-10_patch_02.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatglassfish-jsf-0:1.2_13-5_patch_01.3.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjacorb-jboss-0:2.3.1-10.patch_03.4.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjakarta-commons-logging-jboss-0:1.1-10.3_patch_02.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-aop2-0:2.1.6-2.CP03.1.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjbossas-0:5.1.2-8.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjbossas-tp-licenses-0:5.1.2-7.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjbossas-ws-cxf-0:5.1.2-8.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-cache-core-0:3.2.8-1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-cl-0:2.0.10-1.2.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-cluster-ha-client-0:1.1.4-1.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-common-core-0:2.2.18-1.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-eap5-native-0:5.1.2-1.4.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-ejb3-core-0:1.3.8-0.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-ejb3-proxy-clustered-0:1.0.3-2.SP1.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-ejb3-proxy-impl-0:1.0.6-2.SP2.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-el-0:1.0_02-0.CR6.2.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-messaging-0:1.4.8-9.SP5.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-naming-0:5.0.3-3.CP01.3.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-remoting-0:2.5.4-9.SP3.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-seam2-0:2.2.5.EAP5-7.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjboss-security-spi-1:2.0.4-6.SP8.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjbosssx2-0:2.0.4-6.SP8.2.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjbossts-1:4.6.1-11.CP12.4.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjbossweb-0:2.1.12-1.4_patch_01.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjbossws-0:3.1.2-7.SP11.4.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjbossws-common-0:1.1.0-6.SP8_patch_01.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjbossws-framework-0:3.1.2-6.SP10.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjbossws-spi-0:1.1.2-5.SP7.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjgroups-1:2.6.20-1.1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjopr-embedded-0:1.3.4-18.SP5.8.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjopr-hibernate-plugin-0:3.0.0-13.EmbJopr4.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjopr-jboss-as-5-plugin-0:3.0.0-12.EmbJopr4.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatjopr-jboss-cache-v3-plugin-0:3.0.0-14.EmbJopr4.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatmod_cluster-0:1.0.10-3.2.GA_CP02.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatmod_cluster-native-0:1.0.10-3.1.1.GA_CP02.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatorg-mc4j-ems-0:1.2.15.1-7.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatpicketlink-federation-0:2.0.2-1.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatresteasy-0:1.2.1-9.CP02.5.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatrh-eap-docs-0:5.1.2-6.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatrhq-0:3.0.0-20.EmbJopr4.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatrhq-jmx-plugin-0:3.0.0-20.EmbJopr4.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatrhq-platform-plugin-0:3.0.0-13.EmbJopr4.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatslf4j-0:1.5.8-10_patch_01.2.ep5.el6*
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6RedHatxalan-j2-0:2.7.1-6_patch_05.1.ep5.el6*
Red Hat JBoss Portal 4.3RedHat*
Red Hat JBoss Portal 5RedHat*
Red Hat JBoss SOA Platform 5.1RedHat*

Potential Mitigations

References