CVE-2012-1167

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.

Metrics

CVSS 2.0 4.6/10AV:N/AC:H/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: Nov 23, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-11688.2Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified CVE-2012-11695.3Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names CVE-2012-11707.5Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough CVE-2012-11715.0The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files vi CVE-2012-11725.8The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name CVE-2012-11736.8Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a CVE-2012-11743.3The rm_rf_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to dele CVE-2012-11756.8Integer overflow in the GnashImage::size method in libbase/GnashImage.h in GNU Gnash 0.8.10 allows remote attackers to cause a denial of ser CVE-2012-11765.0Buffer overflow in the fribidi_utf8_to_unicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service (app CVE-2012-11775.1libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote attackers to obtain user names and p CVE-2012-11785.0The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause CVE-2012-11795.2The Linux kernel before 3.3.1, when KVM is used, allows guest OS users to cause a denial of service (host OS crash) by leveraging administra