CVE-2012-4572

LowCVSS 3.7/10Last modified Jun 16, 2026

Description

Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications' authorization decisions via a crafted application.

Metrics

CVSS 2.0 3.7/10AV:L/AC:H/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2013-0833.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0834.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1437.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0833.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0834.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1437.htmlVendor Advisory

Timeline

Published: Oct 28, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-45735.5The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protec CVE-2012-45745.5A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to w CVE-2012-45755.0The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a denial of service (da CVE-2012-45767.8FreeBSD: Input Validation Flaw allows local users to gain elevated privileges CVE-2012-457710.0The Linux firmware image on (1) Korenix Jetport 5600 series serial-device servers and (2) ORing Industrial DIN-Rail serial-device servers ha CVE-2012-45782.1The geli encryption provider 7 before r239184 on FreeBSD 10 uses a weak Master Key, which makes it easier for local users to defeat a crypto CVE-2012-45793.5Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary CVE-2012-45804.3Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Em CVE-2012-45816.8McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does n CVE-2012-45824.9McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows CVE-2012-45834.0McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows CVE-2012-45843.5McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does n