CVE-2011-4085
- State
- Published
- Severity
- Not scored
- Published
- Nov 23, 2012
- Updated
- Aug 6, 2024
- Reserved
- Oct 18, 2011
Description
The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- RHSA-2012:1028vendor-advisory
- 47866third-party-advisory
- RHSA-2011:1805vendor-advisory
- RHSA-2011:1456vendor-advisory
- RHSA-2012:0091vendor-advisory
- RHSA-2011:1822vendor-advisory
- RHSA-2011:1799vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=750422
- RHSA-2011:1798vendor-advisory
- RHSA-2011:1800vendor-advisory
- 47169third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.