CVE-2009-0027

Published Mar 9, 2009

Last updated 16 years ago

Overview

Description: The request handler in JBossWS in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read arbitrary XML files via a crafted request.
Source: secalert@redhat.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 5
Impact score: 2.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: CWE-20

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp01:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "599FBAC3-2E83-443B-AACB-99BBA896CB19"
          },
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp02:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "43590B58-A1C7-4105-A00F-6C4F46A6CC5B"
          },
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp03:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A44F907E-AE57-4213-B001-A23319B72CF8"
          },
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp04:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "243ED156-851C-4897-AF59-86FCA5C9C66F"
          },
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp05:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "125BF8B0-AF1B-4FB1-9D41-D9FB30AE23FC"
          },
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp06:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A3E7C299-8A2D-4733-98AC-F6FA37CC1C6C"
          },
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp01:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2B3E4026-F98E-4AEB-9FE1-4FFBBF44AC55"
          },
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp02:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "960A513A-CAFC-4B3D-ABD7-4659CF545C73"
          },
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp03:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C2D8DC6D-5E39-4A53-8BB8-F998706D573F"
          },
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp04:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3AA2D64E-D7E7-400D-AC7E-CB2045750791"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References