CVE-2012-1154
Improper Access Control in JBoss mod_cluster
mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.
- Record
CVE-2012-1154- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.
- Record
CVE-2012-1154- Updated
- 2026-11-02
EUVDEUVD-2022-5262 No score
mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.
- Record
EUVD-2022-5262- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v2fp-h4qx-x3r6 No score
Improper Access Control in JBoss mod_cluster
mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.
- Record
GHSA-v2fp-h4qx-x3r6- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-v2fp-h4qx-x3r6 No score
Improper Access Control in JBoss mod_cluster
mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.
- Record
GHSA-v2fp-h4qx-x3r6- Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jboss.mod_cluster:mod_clusterMaven |
1.1.0 up to 1.1.4 | 1.1.4 |
org.jboss.mod_cluster:mod_clusterMaven |
1.1.0 up to 1.1.4, plus listed versions 1.1.0.Final1.1.2.Final1.1.3.Final |
1.1.4 |
mod_clusterRed Hat:jboss_enterprise_application_platform:5::el4 |
before 0:1.0.10-4.GA_CP02_patch01.ep5.el4 | 0:1.0.10-4.GA_CP02_patch01.ep5.el4 |
mod_cluster-demoRed Hat:jboss_enterprise_application_platform:5::el4 |
before 0:1.0.10-4.GA_CP02_patch01.ep5.el4 | 0:1.0.10-4.GA_CP02_patch01.ep5.el4 |
mod_cluster-jbossasRed Hat:jboss_enterprise_application_platform:5::el4 |
before 0:1.0.10-4.GA_CP02_patch01.ep5.el4 | 0:1.0.10-4.GA_CP02_patch01.ep5.el4 |
mod_cluster-jbossweb2Red Hat:jboss_enterprise_application_platform:5::el4 |
before 0:1.0.10-4.GA_CP02_patch01.ep5.el4 | 0:1.0.10-4.GA_CP02_patch01.ep5.el4 |
mod_cluster-tomcat6Red Hat:jboss_enterprise_application_platform:5::el4 |
before 0:1.0.10-4.GA_CP02_patch01.ep5.el4 | 0:1.0.10-4.GA_CP02_patch01.ep5.el4 |
mod_clusterRed Hat:jboss_enterprise_application_platform:5::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-demoRed Hat:jboss_enterprise_application_platform:5::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-jbossasRed Hat:jboss_enterprise_application_platform:5::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_cluster-jbossweb2Red Hat:jboss_enterprise_application_platform:5::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-tomcat6Red Hat:jboss_enterprise_application_platform:5::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_clusterRed Hat:jboss_enterprise_application_platform:5::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-demoRed Hat:jboss_enterprise_application_platform:5::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-jbossasRed Hat:jboss_enterprise_application_platform:5::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-jbossweb2Red Hat:jboss_enterprise_application_platform:5::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-tomcat6Red Hat:jboss_enterprise_application_platform:5::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_clusterRed Hat:jboss_enterprise_web_platform:5::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-demoRed Hat:jboss_enterprise_web_platform:5::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-jbossasRed Hat:jboss_enterprise_web_platform:5::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-jbossweb2Red Hat:jboss_enterprise_web_platform:5::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-tomcat6Red Hat:jboss_enterprise_web_platform:5::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_clusterRed Hat:jboss_enterprise_web_platform:5::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-demoRed Hat:jboss_enterprise_web_platform:5::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-jbossasRed Hat:jboss_enterprise_web_platform:5::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-jbossweb2Red Hat:jboss_enterprise_web_platform:5::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-tomcat6Red Hat:jboss_enterprise_web_platform:5::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_clusterRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-demoRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-jbossasRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-jbossweb2Red Hat:jboss_enterprise_web_server:1::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_cluster-tomcat6Red Hat:jboss_enterprise_web_server:1::el5 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5 |
mod_clusterRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-demoRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-jbossasRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-jbossweb2Red Hat:jboss_enterprise_web_server:1::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
mod_cluster-tomcat6Red Hat:jboss_enterprise_web_server:1::el6 |
before 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 | 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-1154 is a medium vulnerability (CVSS 4.3) in Redhat Jboss Enterprise Application Platform, published October 22, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.59%, the 85th percentile. Fixed in org.jboss.mod_cluster:mod_cluster 1.1.4.
References
rhn.redhat.com/errata/RHSA-2012-1012.html
issues.jboss.org/browse/MODCLUSTER-253
secunia.com/advisories/49636
Show 22 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=802200
community.jboss.org/message/624018
nvd.nist.gov/vuln/detail/CVE-2012-1154
github.com/advisories/GHSA-v2fp-h4qx-x3r6
access.redhat.com/errata/RHSA-2012:1052
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1052.json
cve.org/CVERecord?id=CVE-2012-1154