CVE-2012-3428
User confusion in IronJacamar
EPSS 0.55%
Description
The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource connection in opportunistic circumstances via an invalid connection attempt.
How to fix CVE-2012-3428
To remediate CVE-2012-3428, upgrade the affected package to a fixed version below.
- Maven/org.jboss.ironjacamar:ironjacamar-jdbc—upgrade to 1.0.12.Final or later
Is CVE-2012-3428 being exploited?
Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1.0.12.Final