Every CVE Search/ Get API key

CVE-2012-1167

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2...

4.6 MediumFix available

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.

Exploit likelihood

1.60%Down 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.6

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.

Record
CVE-2012-1167
CVSS 2.0
4.6 MediumAV:N/AC:H/Au:S/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.

Record
CVE-2012-1167
Updated
2026-11-02
EUVDEUVD-2012-1197 No score

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.

Record
EUVD-2012-1197
Updated
2026-11-03
GitHub AdvisoriesGHSA-9f9q-j576-jp97 No score

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2...

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.

Record
GHSA-9f9q-j576-jp97
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jboss-naming
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:5.0.3-4.CP01_patch_01.1.ep5.el4
0:5.0.3-4.CP01_patch_01.1.ep5.el4
jbossas
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:5.1.2-10.ep5.el4
0:5.1.2-10.ep5.el4
jbossas-client
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:5.1.2-10.ep5.el4
0:5.1.2-10.ep5.el4
jbossas-messaging
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:5.1.2-10.ep5.el4
0:5.1.2-10.ep5.el4
jbossas-ws-native
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:5.1.2-10.ep5.el4
0:5.1.2-10.ep5.el4
jboss-naming
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:5.0.3-4.CP01_patch_01.1.ep5.el5
0:5.0.3-4.CP01_patch_01.1.ep5.el5
jbossas
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jbossas-client
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jbossas-messaging
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jbossas-ws-native
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
Show 13 moreShow less
Affected packages
PackageAffectedFixed
jboss-naming
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:5.0.3-4.CP01_patch_01.2.ep5.el6
0:5.0.3-4.CP01_patch_01.2.ep5.el6
jbossas
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jbossas-client
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jbossas-messaging
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jbossas-ws-native
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jboss-naming
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:5.0.3-4.CP01_patch_01.1.ep5.el5
0:5.0.3-4.CP01_patch_01.1.ep5.el5
jbossas-web
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jbossas-web-client
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jbossas-web-ws-native
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jboss-naming
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:5.0.3-4.CP01_patch_01.2.ep5.el6
0:5.0.3-4.CP01_patch_01.2.ep5.el6
jbossas-web
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jbossas-web-client
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jbossas-web-ws-native
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-1167 is a medium vulnerability (CVSS 4.6) in Redhat Jboss Enterprise Application Platform, published November 23, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in jboss-naming 0:5.0.3-4.CP01_patch_01.1.ep5.el4.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open