$ cve CVE-2012-0874 JSON

CVE-2012-0874 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 15.6% (pctl 97)

Patch early

A public exploit exists.

Description

The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	15.56% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-287
On CISA KEV	no
Public exploit	yes
Published	2013-02-05
Last modified	2026-06-16

Affected (3)

Vendor	Product
redhat	jboss enterprise application platform
redhat	jboss enterprise brms platform
redhat	jboss enterprise web platform

Public exploits

Source	Title	Date
exploit-db	EMC Data Protection Advisor DPA Illuminator - EJBInvokerServlet Remote Code Execution	2013-12-11

References

→ the Explorer · watch your stack · NVD