Summaryinfo

A vulnerability has been found in Red Hat JBoss Portal 6.0.0 and classified as problematic. This issue affects some unknown processing of the component JGroups Diagnostics Service. Performing a manipulation results in improper authentication. This vulnerability is cataloged as CVE-2013-2102. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Red Hat JBoss Portal 6.0.0 (Application Server Software). This affects an unknown part of the component JGroups Diagnostics Service. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality. The summary by CVE is:

The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive information (diagnostics) by accessing the service.

The weakness was shared 10/16/2013 as RHSA-2013:1437 as confirmed advisory (Website). It is possible to read the advisory at rhn.redhat.com. This vulnerability is uniquely identified as CVE-2013-2102 since 02/19/2013. The attack needs to be done within the local network. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The advisory points out:

When a JGroups channel was started, the JGroups diagnostics service was enabled by default with no authentication via IP multicast. An attacker on an adjacent network could exploit this flaw to read diagnostics information.

The vulnerability scanner Nessus provides a plugin with the ID 72237 (JBoss Portal 6.1.0 Update (RHSA-2013:1437)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Red Hat Local Security Checks and running in the context l.

Upgrading to version 6.1.0 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (72237), SecurityFocus (BID 56814†) and OSVDB (98633†). Further details are available at redhat.com. The entry VDB-7073 is related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Red Hat

Name

• JBoss Portal

Version

• 6.0.0

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion