CVE-2012-2312

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
JBoss AS 7	JBoss	AS 7 Community Release

References

https://access.redhat.com/security/cve/cve-2012-2312Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2312Issue Tracking, Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2012-2312Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-2312Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2312Issue Tracking, Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2012-2312Third Party Advisory

Timeline

Published: Dec 18, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-23131.2The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG com CVE-2012-23142.1The bootloader configuration module (pyanaconda/bootloader.py) in Anaconda uses 755 permissions for /etc/grub.d, which allows local users to CVE-2012-23154.0admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remo CVE-2012-23166.8Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows r CVE-2012-23174.3The Debian php_crypt_revamped.patch patch for PHP 5.3.x, as used in the php5 package before 5.3.3-7+squeeze4 in Debian GNU/Linux squeeze, th CVE-2012-23185.0msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote serve CVE-2012-23197.2Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel before 3.3.5 allow local users to gain privileges via CVE-2012-23207.8ConnMan before 0.85 does not ensure that netlink messages originate from the kernel, which allows remote attackers to bypass intended access CVE-2012-232110.0The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) host n CVE-2012-23225.0Integer overflow in the dhcpv6_get_option function in gdhcp/client.c in ConnMan before 0.85 allows remote attackers to cause a denial of ser CVE-2012-23247.5Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.7 allow remote administrators to execute arbitrary SQL comma CVE-2012-23257.5SQL injection vulnerability in the User Inline Moderation feature in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.