Read the docs
TI-2012-01000 Aliases CVE-2012-1094GHSA-wq8g-hm94-5rqq

Information disclosure in JBoss AS 7

Priority LOW 35CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.

Why it matters now

EPSS 0.01105 65th percentileScored 2026-11-07
Fix Fixed JBoss AS 7: 7.1.1org.jboss.as:jboss-as-server (Maven): 7.1.1.Final

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—JBoss AS 7before 7.1.17.1.1Patch availableCNA
—org.jboss.as:jboss-as-server (Maven)7.0.0.Alpha1 to before 7.1.1.Final7.1.1.FinalPatch availableGHSA-wq8g-hm94-5rqq
  • JBoss AS 7 Vendor— Affected before 7.1.1 Fixed in 7.1.1 Patch available CNA
  • org.jboss.as:jboss-as-server (Maven) Vendor— Affected 7.0.0.Alpha1 to before 7.1.1.Final Fixed in 7.1.1.Final Patch available GHSA-wq8g-hm94-5rqq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_application_server:*:*:*:*:*:*:*:*7.0.0 to before 7.1.1VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_application_server:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.1.1 Vulnerable ·Red Hat

Remediation

  • Fix · CNA JBoss AS 7 Fixed in 7.1.1
  • Fix · GHSA-wq8g-hm94-5rqq org.jboss.as:jboss-as-server (Maven) Fixed in 7.1.1.Final Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat JBoss BRMS 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-1094
  2. 2026-10-03 Alias added: GHSA-wq8g-hm94-5rqq

References

Advisory 3

  • TI-2012-02050 Improper privilege management in JBoss CVSS 3.1HIGH 7.8
  • TI-2013-03249 The Embedded Jopr component in JBoss Application Server includes the cleartext datasource… CVSS 3.0MEDIUM 6.6
  • TI-2011-03183 Cross-site request forgery in JBoss Application Server CVSS 3.1MEDIUM 6.5
  • TI-2011-03181 Cross-site scripting in JBoss Application Server CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences