Description
The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 5 | apache-cxf | 2.2.12-4.patch_02.1.ep5.el6 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | cglib | 2.2-5.3.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | facelets | 1.1.15-3.B1_patch_01.2.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | glassfish-jaxb | 2.1.12-10_patch_02.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | glassfish-jsf | 1.2_13-5_patch_01.3.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jacorb-jboss | 2.3.1-10.patch_03.4.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jakarta-commons-logging-jboss | 1.1-10.3_patch_02.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-aop2 | 2.1.6-2.CP03.1.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-cache-core | 3.2.8-1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-cl | 2.0.10-1.2.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-cluster-ha-client | 1.1.4-1.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-common-core | 2.2.18-1.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-eap5-native | 5.1.2-1.4.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-ejb3-core | 1.3.8-0.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-ejb3-proxy-clustered | 1.0.3-2.SP1.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-ejb3-proxy-impl | 1.0.6-2.SP2.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-el | 1.0_02-0.CR6.2.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-messaging | 1.4.8-9.SP5.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-naming | 5.0.3-3.CP01.3.ep5.el6 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-remoting | 2.5.4-9.SP3.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-seam2 +3 | 2.2.5.EAP5-5.ep5.el5 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jboss-security-spi | 1:2.0.4-6.SP8.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jbossas +4 | 5.1.2-8.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jbossas-tp-licenses | 5.1.2-7.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jbosssx2 | 2.0.4-6.SP8.2.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jbossts +1 | 1:4.6.1-11.CP12.4.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jbossweb +4 | 2.1.12-1.4_patch_01.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jbossws | 3.1.2-7.SP11.4.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jbossws-common | 1.1.0-6.SP8_patch_01.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jbossws-framework | 3.1.2-6.SP10.1.ep5.el6 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jbossws-spi | 1.1.2-5.SP7.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jgroups | 1:2.6.20-1.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jopr-embedded | 1.3.4-18.SP5.8.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jopr-jboss-as-5-plugin | 3.0.0-12.EmbJopr4.ep5.el5 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | jopr-jboss-cache-v3-plugin | 3.0.0-14.EmbJopr4.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | mod_cluster +5 | 1.0.10-3.GA_CP02.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | org-mc4j-ems | 1.2.15.1-4.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | picketlink-federation +3 | 2.0.2-1.ep5.el6 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | resteasy +3 | 1.2.1-9.CP02.4.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | rh-eap-docs +1 | 5.1.2-6.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | rhq +24 | 3.0.0-20.EmbJopr4.ep5.el5 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | rhq-platform-plugin +1 | 3.0.0-13.EmbJopr4.ep5.el5 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | slf4j | 1.5.8-10_patch_01.2.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
| Red Hat JBoss EAP 5 | xalan-j2 | 2.7.1-6_patch_05.1.ep5.el4 | RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798 |
Advisories 3
- RHSA-2011:1800 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2011:1798 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2011:1799 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2012:1028 vendor-advisory
- 47866 third-party-advisory
- RHSA-2011:1805 vendor-advisory
- RHSA-2011:1456 vendor-advisory
- RHSA-2012:0091 vendor-advisory
- RHSA-2011:1822 vendor-advisory
- RHSA-2011:1799 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=750422
- RHSA-2011:1798 vendor-advisory
- RHSA-2011:1800 vendor-advisory
- 47169 third-party-advisory