CVE-2012-1167
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2...
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.
Exploit likelihood
What each source reports
NVD Score used
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.
- Record
CVE-2012-1167- CVSS 2.0
- 4.6 Medium
AV:N/AC:H/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.
- Record
CVE-2012-1167- Updated
- 2026-11-02
EUVDEUVD-2012-1197 No score
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.
- Record
EUVD-2012-1197- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9f9q-j576-jp97 No score
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2...
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.
- Record
GHSA-9f9q-j576-jp97- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jboss-namingRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs |
before 0:5.0.3-4.CP01_patch_01.1.ep5.el4 | 0:5.0.3-4.CP01_patch_01.1.ep5.el4 |
jbossasRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el4 | 0:5.1.2-10.ep5.el4 |
jbossas-clientRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el4 | 0:5.1.2-10.ep5.el4 |
jbossas-messagingRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el4 | 0:5.1.2-10.ep5.el4 |
jbossas-ws-nativeRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el4 | 0:5.1.2-10.ep5.el4 |
jboss-namingRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs |
before 0:5.0.3-4.CP01_patch_01.1.ep5.el5 | 0:5.0.3-4.CP01_patch_01.1.ep5.el5 |
jbossasRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el5 | 0:5.1.2-10.ep5.el5 |
jbossas-clientRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el5 | 0:5.1.2-10.ep5.el5 |
jbossas-messagingRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el5 | 0:5.1.2-10.ep5.el5 |
jbossas-ws-nativeRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el5 | 0:5.1.2-10.ep5.el5 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jboss-namingRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs |
before 0:5.0.3-4.CP01_patch_01.2.ep5.el6 | 0:5.0.3-4.CP01_patch_01.2.ep5.el6 |
jbossasRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el6 | 0:5.1.2-10.ep5.el6 |
jbossas-clientRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el6 | 0:5.1.2-10.ep5.el6 |
jbossas-messagingRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el6 | 0:5.1.2-10.ep5.el6 |
jbossas-ws-nativeRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el6 | 0:5.1.2-10.ep5.el6 |
jboss-namingRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs |
before 0:5.0.3-4.CP01_patch_01.1.ep5.el5 | 0:5.0.3-4.CP01_patch_01.1.ep5.el5 |
jbossas-webRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el5 | 0:5.1.2-10.ep5.el5 |
jbossas-web-clientRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el5 | 0:5.1.2-10.ep5.el5 |
jbossas-web-ws-nativeRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el5 | 0:5.1.2-10.ep5.el5 |
jboss-namingRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs |
before 0:5.0.3-4.CP01_patch_01.2.ep5.el6 | 0:5.0.3-4.CP01_patch_01.2.ep5.el6 |
jbossas-webRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el6 | 0:5.1.2-10.ep5.el6 |
jbossas-web-clientRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el6 | 0:5.1.2-10.ep5.el6 |
jbossas-web-ws-nativeRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs |
before 0:5.1.2-10.ep5.el6 | 0:5.1.2-10.ep5.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-1167 is a medium vulnerability (CVSS 4.6) in Redhat Jboss Enterprise Application Platform, published November 23, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. No source names a fixed version.
References
bugzilla.redhat.com/show_bug.cgi?id=802622
rhn.redhat.com/errata/RHSA-2012-1028.html
secunia.com/advisories/49658
Show 21 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/76680
securityfocus.com/bid/54089
securitytracker.com/id?1027501
nvd.nist.gov/vuln/detail/CVE-2012-1167
github.com/advisories/GHSA-9f9q-j576-jp97
access.redhat.com/errata/RHSA-2012:1026
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1026.json
cve.org/CVERecord?id=CVE-2011-4605