Every CVESearch/Get API key

CVE-2011-4608

mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes...

7.5 HighFix available

CVE-2011-4608 is a high vulnerability (CVSS 7.5) in Redhat Jboss Enterprise Application Platform, published January 27, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.14%, the 88th percentile. Fixed in mod_cluster 0:1.0.10-3.GA_CP02.ep5.el4.

What does this mean?
Severity
7.5 HighCVSS 2.0, NVD
Exploit chance
3.14%EPSS, 88th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0:1.0.10-3.GA_CP02.ep5.el4mod_cluster +24 more

Description

mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.

Exploit likelihood

3.14%Up 1.0 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mod_cluster
Red Hat:jboss_enterprise_web_server:1::el4
before 0:1.0.10-3.GA_CP02.ep5.el4
0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster-demo
Red Hat:jboss_enterprise_web_server:1::el4
before 0:1.0.10-3.GA_CP02.ep5.el4
0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster-jbossas
Red Hat:jboss_enterprise_web_server:1::el4
before 0:1.0.10-3.GA_CP02.ep5.el4
0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster-jbossweb2
Red Hat:jboss_enterprise_web_server:1::el4
before 0:1.0.10-3.GA_CP02.ep5.el4
0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster-native
Red Hat:jboss_enterprise_web_server:1::el4
before 0:1.0.10-4.GA_CP02.ep5.el4
0:1.0.10-4.GA_CP02.ep5.el4
mod_cluster-native-debuginfo
Red Hat:jboss_enterprise_web_server:1::el4
before 0:1.0.10-4.GA_CP02.ep5.el4
0:1.0.10-4.GA_CP02.ep5.el4
mod_cluster-tomcat6
Red Hat:jboss_enterprise_web_server:1::el4
before 0:1.0.10-3.GA_CP02.ep5.el4
0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster
Red Hat:jboss_enterprise_web_server:1::el5
before 0:1.0.10-3.1.GA_CP02.ep5.el5
0:1.0.10-3.1.GA_CP02.ep5.el5
mod_cluster-demo
Red Hat:jboss_enterprise_web_server:1::el5
before 0:1.0.10-3.1.GA_CP02.ep5.el5
0:1.0.10-3.1.GA_CP02.ep5.el5
mod_cluster-jbossas
Red Hat:jboss_enterprise_web_server:1::el5
before 0:1.0.10-3.1.GA_CP02.ep5.el5
0:1.0.10-3.1.GA_CP02.ep5.el5
Show 15 moreShow less
Affected packages
PackageAffectedFixed
mod_cluster-jbossweb2
Red Hat:jboss_enterprise_web_server:1::el5
before 0:1.0.10-3.1.GA_CP02.ep5.el5
0:1.0.10-3.1.GA_CP02.ep5.el5
mod_cluster-native
Red Hat:jboss_enterprise_web_server:1::el5
before 0:1.0.10-4.1.GA_CP02.ep5.el5
0:1.0.10-4.1.GA_CP02.ep5.el5
mod_cluster-tomcat6
Red Hat:jboss_enterprise_web_server:1::el5
before 0:1.0.10-3.1.GA_CP02.ep5.el5
0:1.0.10-3.1.GA_CP02.ep5.el5
mod_cluster
Red Hat:jboss_enterprise_web_server:1::el6
before 0:1.0.10-3.2.GA_CP02.ep5.el6
0:1.0.10-3.2.GA_CP02.ep5.el6
mod_cluster-demo
Red Hat:jboss_enterprise_web_server:1::el6
before 0:1.0.10-3.2.GA_CP02.ep5.el6
0:1.0.10-3.2.GA_CP02.ep5.el6
mod_cluster-jbossas
Red Hat:jboss_enterprise_web_server:1::el6
before 0:1.0.10-3.2.GA_CP02.ep5.el6
0:1.0.10-3.2.GA_CP02.ep5.el6
mod_cluster-jbossweb2
Red Hat:jboss_enterprise_web_server:1::el6
before 0:1.0.10-3.2.GA_CP02.ep5.el6
0:1.0.10-3.2.GA_CP02.ep5.el6
mod_cluster-native
Red Hat:jboss_enterprise_web_server:1::el6
before 0:1.0.10-4.1.1.GA_CP02.ep5.el6
0:1.0.10-4.1.1.GA_CP02.ep5.el6
mod_cluster-tomcat6
Red Hat:jboss_enterprise_web_server:1::el6
before 0:1.0.10-3.2.GA_CP02.ep5.el6
0:1.0.10-3.2.GA_CP02.ep5.el6
mod_cluster-native
Red Hat:jboss_enterprise_application_platform:5::el4
before 0:1.0.10-4.GA_CP02.ep5.el4
0:1.0.10-4.GA_CP02.ep5.el4
mod_cluster-native-debuginfo
Red Hat:jboss_enterprise_application_platform:5::el4
before 0:1.0.10-4.GA_CP02.ep5.el4
0:1.0.10-4.GA_CP02.ep5.el4
mod_cluster-native
Red Hat:jboss_enterprise_application_platform:5::el5
before 0:1.0.10-4.1.GA_CP02.ep5.el5
0:1.0.10-4.1.GA_CP02.ep5.el5
mod_cluster-native
Red Hat:jboss_enterprise_application_platform:5::el6
before 0:1.0.10-4.1.1.GA_CP02.ep5.el6
0:1.0.10-4.1.1.GA_CP02.ep5.el6
mod_cluster-native
Red Hat:jboss_enterprise_web_platform:5::el5
before 0:1.0.10-4.1.GA_CP02.ep5.el5
0:1.0.10-4.1.GA_CP02.ep5.el5
mod_cluster-native
Red Hat:jboss_enterprise_web_platform:5::el6
before 0:1.0.10-4.1.1.GA_CP02.ep5.el6
0:1.0.10-4.1.1.GA_CP02.ep5.el6

What each source reports

NVD Score used7.5

mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.

Record
CVE-2011-4608
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE ListNo score

mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.

Record
CVE-2011-4608
Updated
2026-11-02
EUVDEUVD-2011-4532No score

mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.

Record
EUVD-2011-4532
Updated
2026-11-03
GitHub AdvisoriesGHSA-3vmm-p7jr-jw44No score

mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes...

mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.

Record
GHSA-3vmm-p7jr-jw44
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 19 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open