Description

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remote attackers to gain privileges as other users.

Remediation

References

CVE-2012-3370

Related Vulnerabilities

WordPress Plugin Coming Soon & Maintenance Mode Page Cross-Site Request Forgery (1.57)

WordPress Plugin WPFront Scroll Top Cross-Site Scripting (2.0.6.07225)

Ruby Resource Management Errors Vulnerability (CVE-2008-3656)

phpMyFAQ Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2014-6045)

Oracle JRE CVE-2020-2781 Vulnerability (CVE-2020-2781)

Severity

Medium

Classification

CVE-2012-3370 CWE-264

Tags

Missing Update Known Vulnerabilities