Vulnerability Description
An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Jboss Application Server | 7.1.0 |
| Redhat | Jboss Enterprise Application Platform | 6.0.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/cve-2012-2312Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2312Issue TrackingVendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2012-2312Third Party Advisory
- https://access.redhat.com/security/cve/cve-2012-2312Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2312Issue TrackingVendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2012-2312Third Party Advisory
FAQ
What is CVE-2012-2312?
CVE-2012-2312 is a vulnerability with a CVSS score of 7.8 (HIGH). An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains...
How severe is CVE-2012-2312?
CVE-2012-2312 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-2312?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Jboss Application Server, Redhat Jboss Enterprise Application Platform.