cbcvebase.
CVE-2011-4085
published 2012-11-23

CVE-2011-4085: The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal…

PriorityP277medium6.8CVSS 2.0
AVNACMAuNCPIPAP
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.95%
85.6th percentile
The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.

Affected

15 ranges
VendorProductVersion rangeFixed in
redhatjboss_enterprise_application_platform<= 5.1.1—
redhatjboss_enterprise_application_platform——
redhatjboss_enterprise_application_platform——
redhatjboss_enterprise_application_platform——
redhatjboss_enterprise_application_platform——
redhatjboss_enterprise_application_platform——
redhatjboss_enterprise_brms_platform<= 5.2.0—
redhatjboss_enterprise_portal_platform<= 4.3.0—
redhatjboss_enterprise_soa_platform<= 5.1.1—
redhatjboss_enterprise_soa_platform——
redhatjboss_enterprise_soa_platform——
redhatjboss_enterprise_soa_platform——
redhatjboss_enterprise_soa_platform——
redhatjboss_enterprise_soa_platform——
redhatjboss_enterprise_soa_platform——

Detection & IOCsextracted from sources · hover to see the quote

  • →Authentication bypass is achieved by sending HTTP requests using methods other than GET or POST (HTTP verb tampering) to servlets invoked by httpha-invoker, since access control only applies to GET and POST methods. ↗
  • →The attack targets invoker servlets deployed by httpha-invoker; monitor for non-GET/non-POST HTTP methods (e.g., HEAD, PUT, DELETE, TRACE, OPTIONS) directed at JBoss invoker servlet paths. ↗
  • →Exploitability increases significantly if the JBoss security interceptor (second layer of authentication) is misconfigured or disabled; prioritize detection on systems where the security interceptor may be absent. ↗
  • ·The vulnerability is a regression of CVE-2010-0738; systems that were patched for CVE-2010-0738 but later upgraded to affected JBoss versions may have reintroduced the flaw. The fix requires removing verb-specific elements from web.xml. ↗
  • ·Direct exploitation is blocked by a second authentication layer (security interceptor); the vulnerability is only directly exploitable if that interceptor is misconfigured or disabled. ↗

CVSS provenance

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck5.3MEDIUM
vendor_redhat5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.