Every CVE Search/ Get API key

CVE-2011-4605

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss...

7.5 HighFix available

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

Exploit likelihood

3.52%Down 0.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

Record
CVE-2011-4605
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

Record
CVE-2011-4605
Updated
2026-11-02
EUVDEUVD-2011-4529 No score

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

Record
EUVD-2011-4529
Updated
2026-11-03
GitHub AdvisoriesGHSA-985p-jvqf-v48m No score

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss...

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.

Record
GHSA-985p-jvqf-v48m
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jbossas
Red Hat:jboss_enterprise_application_platform:4.3.0::el4
 before 0:4.3.0-10.GA_CP10_patch_01.1.ep1.el4
0:4.3.0-10.GA_CP10_patch_01.1.ep1.el4
jbossas-client
Red Hat:jboss_enterprise_application_platform:4.3.0::el4
 before 0:4.3.0-10.GA_CP10_patch_01.1.ep1.el4
0:4.3.0-10.GA_CP10_patch_01.1.ep1.el4
jbossas
Red Hat:jboss_enterprise_application_platform:4.3.0::el5
 before 0:4.3.0-10.GA_CP10_patch_01.1.ep1.el5
0:4.3.0-10.GA_CP10_patch_01.1.ep1.el5
jbossas-client
Red Hat:jboss_enterprise_application_platform:4.3.0::el5
 before 0:4.3.0-10.GA_CP10_patch_01.1.ep1.el5
0:4.3.0-10.GA_CP10_patch_01.1.ep1.el5
jboss-naming
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:5.0.3-4.CP01_patch_01.1.ep5.el4
0:5.0.3-4.CP01_patch_01.1.ep5.el4
jbossas
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:5.1.2-10.ep5.el4
0:5.1.2-10.ep5.el4
jbossas-client
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:5.1.2-10.ep5.el4
0:5.1.2-10.ep5.el4
jbossas-messaging
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:5.1.2-10.ep5.el4
0:5.1.2-10.ep5.el4
jbossas-ws-native
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:5.1.2-10.ep5.el4
0:5.1.2-10.ep5.el4
jboss-naming
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:5.0.3-4.CP01_patch_01.1.ep5.el5
0:5.0.3-4.CP01_patch_01.1.ep5.el5
Show 17 moreShow less
Affected packages
PackageAffectedFixed
jbossas
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jbossas-client
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jbossas-messaging
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jbossas-ws-native
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jboss-naming
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:5.0.3-4.CP01_patch_01.2.ep5.el6
0:5.0.3-4.CP01_patch_01.2.ep5.el6
jbossas
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jbossas-client
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jbossas-messaging
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jbossas-ws-native
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jboss-naming
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:5.0.3-4.CP01_patch_01.1.ep5.el5
0:5.0.3-4.CP01_patch_01.1.ep5.el5
jbossas-web
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jbossas-web-client
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jbossas-web-ws-native
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:5.1.2-10.ep5.el5
0:5.1.2-10.ep5.el5
jboss-naming
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:5.0.3-4.CP01_patch_01.2.ep5.el6
0:5.0.3-4.CP01_patch_01.2.ep5.el6
jbossas-web
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jbossas-web-client
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6
jbossas-web-ws-native
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:5.1.2-10.ep5.el6
0:5.1.2-10.ep5.el6

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4605 is a high vulnerability (CVSS 7.5) in Redhat Jboss Enterprise Application Platform, published November 23, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.52%, the 89th percentile. Fixed in jbossas 0:4.3.0-10.GA_CP10_patch_01.1.ep1.el4.

References

Show 36 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open