What is the CVSS score of CVE-2012-2377?

CVE-2012-2377 has a CVSS 2.0 base score of 3.3 (Low). CVSS vector: AV:A/AC:L/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 1.0%.

Jboss Enterprise Soa Platform CVE-2012-2377

LOW

Improper Authentication (CWE-287)

2012-11-23 secalert@redhat.com

Authentication Bypass Red Hat Jboss Enterprise Soa Platform Jboss Enterprise Portal Platform Jboss Enterprise Brms Platform

3.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:A/AC:L/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Nov 23, 2012 - 20:55 cve.org

LOW 3.3

DescriptionCVE.org

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast.

AnalysisAI

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast. Affected products include: Redhat Jboss Enterprise Portal Platform, Redhat Jboss Enterprise Soa Platform, Redhat Jboss Enterprise Brms Platform. Version information: before 5.2.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.