CVE-2013-4128

Опубликовано: 11 июл. 2013

Источник: redhat

CVSS2: 6.4

Описание

Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat JBoss Data Grid 6	remote-naming	Not affected
Red Hat JBoss Portal 6	remote-naming	Affected
Red Hat JBoss Enterprise Application Platform 6.1		Fixed	RHSA-2013:1152	12.08.2013
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5	jboss-as-client-all	Fixed	RHSA-2013:1151	12.08.2013
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5	jboss-ejb-client	Fixed	RHSA-2013:1151	12.08.2013
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5	jboss-remote-naming	Fixed	RHSA-2013:1151	12.08.2013
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6	jboss-as-client-all	Fixed	RHSA-2013:1151	12.08.2013
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6	jboss-ejb-client	Fixed	RHSA-2013:1151	12.08.2013
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6	jboss-remote-naming	Fixed	RHSA-2013:1151	12.08.2013
Red Hat JBoss Portal Platform 6.1		Fixed	RHSA-2013:1437	16.10.2013

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Important

Дефект:

CWE-384

https://bugzilla.redhat.com/show_bug.cgi?id=984795remote-naming: Session fixation due improper connection caching

6.4 Medium

CVSS2

Связанные уязвимости

CVE-2013-4128

ubuntu

почти 13 лет назад

Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.

CVE-2013-4128

nvd

почти 13 лет назад

Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.

CVE-2013-4128

debian

почти 13 лет назад

Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not pro ...

GHSA-mj2q-jjfm-w2rq

github

около 4 лет назад

Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.

6.4 Medium

CVSS2