CVE-2012-1094

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	JBoss AS 7	prior to 7.1.1

References

https://access.redhat.com/security/cve/cve-2012-1094Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1094Issue Tracking, Vendor Advisory
https://access.redhat.com/security/cve/cve-2012-1094Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1094Issue Tracking, Vendor Advisory

Timeline

Published: Mar 10, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-10954.3osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log CVE-2012-10965.5NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file pat CVE-2012-10977.8The regset (aka register set) feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which CVE-2012-10984.3Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote atta CVE-2012-10994.3Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails CVE-2012-11005.8Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account CVE-2012-11015.5systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedure).CVE-2012-11027.5It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially unt CVE-2012-11034.3emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files CVE-2012-11045.3A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed.CVE-2012-11055.5An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentica CVE-2012-11061.9The C handler plug-in in Automatic Bug Reporting Tool (ABRT), possibly 2.0.8 and earlier, does not properly set the group (GID) permissions