Unscored CVE-2009-4843 EUVD-2009-4806GHSA-9cw6-3jhc-97m4

ToutVirtual VirtualIQ Pro before 3.5 build 8691 does not require administrative authentication for JBoss console access, which allows remot…

Published May 7, 2010 · Updated Aug 7, 2024 · Assigned by mitre

Description

ToutVirtual VirtualIQ Pro before 3.5 build 8691 does not require administrative authentication for JBoss console access, which allows remote attackers to execute arbitrary commands via requests to (1) the JMX Management Console or (2) the Web Console.

References

37297 third-party-advisory
20091107 ToutVirtual VirtualIQ Multiple Vulnerabilities mailing-list
http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt