CVE-2017-12189

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could result in local privilege escalation. This issue is a result of an incomplete fix for CVE-2016-8656.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-282

Affected software

Vendor	Product	Versions
Red Hat, Inc.	Red Hat JBoss Enterprise Application Platform	7.0.7.GA

References

http://www.securityfocus.com/bid/102407Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0002Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0003Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0004Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0005Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12189Issue Tracking, Third Party Advisory
http://www.securityfocus.com/bid/102407Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0002Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0003Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0004Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0005Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12189Issue Tracking, Third Party Advisory

Timeline

Published: Jan 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-12196.5IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could CVE-2017-121906.5The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O CVE-2017-121917.4A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access CVE-2017-121925.5The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properl CVE-2017-121935.5The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which CVE-2017-121949.8A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-ser CVE-2017-121954.8A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name CVE-2017-121965.9undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not en CVE-2017-121976.5It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password CVE-2017-121999.8The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue CVE-2017-12205.3IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) discloses sensitive information to unauthorized users. The information can be CVE-2017-122006.1The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.