Description
mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 1 | mod_cluster +4 | 1.0.10-4.1.GA_CP02_patch01.ep5.el5 | RHSA-2012:1166 |
| Red Hat JBoss Web Platform 5 | mod_cluster +4 | 1.0.10-4.1.GA_CP02_patch01.ep5.el5 | RHSA-2012:1053 |
| Red Hat JBoss EAP 5 | mod_cluster +4 | 1.0.10-4.GA_CP02_patch01.ep5.el4 | RHSA-2012:1052 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.mod_cluster:mod_cluster | >= 1.1.0, < 1.1.4 | 1.1.4 | GHSA-v2fp-h4qx-x3r6 |
Advisories 3
- RHSA-2012:1166 Red Hat Security Advisory: mod_cluster security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2012:1053 Red Hat Security Advisory: mod_cluster security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2012:1052 Red Hat Security Advisory: mod_cluster security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2012:1012 vendor-advisory
- RHSA-2012:1166 vendor-advisory
- RHSA-2012:1052 vendor-advisory
- RHSA-2012:1053 vendor-advisory
- https://issues.jboss.org/browse/MODCLUSTER-253
- 49636 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=802200
- RHSA-2012:1010 vendor-advisory
- RHSA-2012:1011 vendor-advisory
- https://community.jboss.org/message/624018