Redhat: >> Jboss Enterprise Application Platform >> 6.0.1 Security Vulnerabilities
Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications' authorization decisions via a crafted application.
CVSS Score
3.7
EPSS Score
0.002
Published
2013-10-28
PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.
CVSS Score
1.9
EPSS Score
0.0
Published
2013-09-28
The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.
CVSS Score
7.5
EPSS Score
0.008
Published
2013-03-12
Page 3