CVE-2011-4573

Red Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce "modify resource" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2012-0089.html	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=760024

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:jboss_operations_network::::::::
	cpe:2.3:a:redhat:jboss_operations_network:1.0.0:::::::*
	cpe:2.3:a:redhat:jboss_operations_network:2.0.0:::::::*
	cpe:2.3:a:redhat:jboss_operations_network:2.0.1:::::::*
	cpe:2.3:a:redhat:jboss_operations_network:2.1.0:::::::*
	cpe:2.3:a:redhat:jboss_operations_network:2.2:::::::*
	cpe:2.3:a:redhat:jboss_operations_network:2.3:::::::*
	cpe:2.3:a:redhat:jboss_operations_network:2.3.1:::::::*
	cpe:2.3:a:redhat:jboss_operations_network:2.4:::::::*

History

No history.

Information

Published : 2014-04-01 06:35

Updated : 2014-04-01 14:38

NVD link : CVE-2011-4573

Mitre link : CVE-2011-4573

CVE.ORG link : CVE-2011-4573

JSON object : View

Products Affected

redhat

jboss_operations_network

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2011-4573", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-04-01T06:35:52.497", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2012-0089.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=760024", "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Red Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce \"modify resource\" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail."}, {"lang": "es", "value": "Red Hat JBoss Operations Network (JON) anterior a 2.4.2 no fuerza debidamente permisos de modificar recurso para usuarios remotos autenticados cuando elimina una actualizaci\u00f3n de configuraci\u00f3n de plugin del historial de propiedades de conexi\u00f3n de grupo, lo que previene tales actividades de ser registradas en el registro de auditor\u00eda."}], "lastModified": "2014-04-01T14:38:49.943", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_operations_network:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87E50BCC-4B27-43F7-8AB3-EC27297C4B2C", "versionEndIncluding": "2.4.1"}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC1625FD-302E-457E-BDD1-977DE614CB47"}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D29DC3CE-E782-47F7-BDF4-4AB63728F05B"}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF4A10F6-2128-4986-8A28-BD9B679D8380"}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B720DED-23EE-4830-9C8B-441A38DAE80E"}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FD44168-A91A-4043-8C34-7A20DC2C1A19"}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66926B59-4A4F-47B9-9B2B-3D8DC698BC97"}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D72DFB62-EEA6-4126-9DC3-B191CC8D0CA5"}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8DBE132-2A98-40C6-947F-50C1D06DDFB1"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}