VULNERABILITY INTELLIGENCE

CVE-2012-1167

CVSS score4.6 MEDIUM
EPSS probability1.60%
CISA KEVNot currently listed
Published2012-11-23
Last modified2026-06-16
CVSS vectorAV:N/AC:H/Au:S/C:P/I:P/A:P

Description

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.

Primary references