Red Hat JBoss Application Server vulnerabilities

5 CVEs affecting Red Hat JBoss Application Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-1094, published 2020-03-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-3734, published 2017-10-24. Medium severity, CVSS 6.6. EPSS: 1.6% chance of exploitation in the next 30 days. The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive…
CVE-2011-3609, published 2019-11-26. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP…
CVE-2012-1094, published 2020-03-10. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.
CVE-2011-3606, published 2019-11-26. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick…
CVE-2012-2312, published 2019-12-18. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still…