Read the docs
TI-2012-02106 Aliases CVE-2012-2377GHSA-jm5c-rgfp-cjhx

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA…

Priority LOW 19CWE-287Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 9 fixed, 3 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-287.

Summary

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast.

Why it matters now

EPSS 0.01448 73rd percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 9 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:*:*:*:*:*:*:*:*up to 5.2.1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:cp07:*:*:*:*:*:*4.3.0 cp07VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.1.1:*:*:*:*:*:*:*5.1.1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:*:*:*:*:*:*:*:*up to 5.2.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:*:*:*:*:*:*:*:* Versions up to 5.2.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:cp07:*:*:*:*:*:* Versions 4.3.0 cp07 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:*:*:*:*:*:*:*:* Versions up to 5.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Red Hat
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp01:*:*:*:*:*:*4.2.0 cp01VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp02:*:*:*:*:*:*4.2.0 cp02VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp03:*:*:*:*:*:*4.2.0 cp03VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp04:*:*:*:*:*:*4.2.0 cp04VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp05:*:*:*:*:*:*4.2.0 cp05VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:tp02:*:*:*:*:*:*4.2.0 tp02VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp01:*:*:*:*:*:*4.3.0 cp01VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp02:*:*:*:*:*:*4.3.0 cp02VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp03:*:*:*:*:*:*4.3.0 cp03VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp04:*:*:*:*:*:*4.3.0 cp04VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp05:*:*:*:*:*:*4.3.0 cp05VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.2:*:*:*:*:*:*:*5.0.2VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.1.1:*:*:*:*:*:*:*5.1.1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:*up to 5.2.0VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp01:*:*:*:*:*:* Versions 4.2.0 cp01 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp02:*:*:*:*:*:* Versions 4.2.0 cp02 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp03:*:*:*:*:*:* Versions 4.2.0 cp03 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp04:*:*:*:*:*:* Versions 4.2.0 cp04 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp05:*:*:*:*:*:* Versions 4.2.0 cp05 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:tp02:*:*:*:*:*:* Versions 4.2.0 tp02 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp01:*:*:*:*:*:* Versions 4.3.0 cp01 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp02:*:*:*:*:*:* Versions 4.3.0 cp02 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp03:*:*:*:*:*:* Versions 4.3.0 cp03 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp04:*:*:*:*:*:* Versions 4.3.0 cp04 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp05:*:*:*:*:*:* Versions 4.3.0 cp05 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:* Versions up to 5.2.0 Vulnerable ·Red Hat

Remediation

Red Hat 11 advisories

  • RHSA-2013:0198 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5.2
  • RHSA-2013:0197 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5 for RHEL 4 AS aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
    • Red Hat JBoss Web Platform 5 for RHEL 4 ES aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
  • RHSA-2013:0196 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5 for RHEL 5 Server aopalliance-1.0-5.2.jdk6.ep5.el5, apache-cxf-2.2.12-6.1.patch_04.ep5.el5, bsh2-2.0-0.b4.15.1.patch01.ep5.el5 +47
Show 8 more Red Hat advisories
  • RHSA-2013:0195 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5 for RHEL 6 Server aopalliance-1.0-5.3.ep5.el6, apache-cxf-2.2.12-6.1.patch_04.ep5.el6, bsh2-2.0-0.b4.15.patch01.ep5.el6 +47
  • RHSA-2013:0193 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
  • RHSA-2013:0191 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server aopalliance-1.0-5.3.ep5.el6, apache-cxf-2.2.12-6.1.patch_04.ep5.el6, bsh2-2.0-0.b4.15.patch01.ep5.el6 +47
  • RHSA-2013:0192 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server aopalliance-1.0-5.2.jdk6.ep5.el5, apache-cxf-2.2.12-6.1.patch_04.ep5.el5, bsh2-2.0-0.b4.15.1.patch01.ep5.el5 +47
  • RHSA-2013:0194 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5.2
  • RHSA-2012:1232 Released 2012-09-05 · Red Hat rating Important
    JBoss Enterprise Portal Platform 5.2.2 update
    • Red Hat JBoss Portal 5.2
  • RHSA-2012:1125 Released 2012-07-31 · Red Hat rating Important
    JBoss Enterprise SOA Platform 5.3.0 update
    • Red Hat JBoss SOA Platform 5.3
  • RHSA-2012:1028 Released 2012-06-22 · Red Hat rating Important
    JBoss Enterprise BRMS Platform 5.3.0 update
    • JBoss Enterprise BRMS Platform 5.3

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss BRMS 5AffectedNo fix yet
Red Hat JBoss Portal 5AffectedNo fix yet
Red Hat JBoss SOA Platform 5AffectedNo fix yet
JBoss Enterprise BRMS Platform 5.3Fixed RHSA-2012:1028
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2013:0192
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2013:0191
Red Hat JBoss Enterprise Application Platform 5.2Fixed RHSA-2013:0194
Red Hat JBoss Portal 5.2Fixed RHSA-2012:1232
Red Hat JBoss SOA Platform 5.3Fixed RHSA-2012:1125
Red Hat JBoss Web Platform 5 for RHEL 5 ServerFixed RHSA-2013:0196
Red Hat JBoss Web Platform 5 for RHEL 6 ServerFixed RHSA-2013:0195
Red Hat JBoss Web Platform 5.2Fixed RHSA-2013:0198

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-2377
  2. 2026-10-03 Alias added: GHSA-jm5c-rgfp-cjhx

References

Advisory 11

Other 2

  • TI-2015-06239 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data… CVSS 3.0CRITICAL 9.8
  • TI-2016-04319 SQL injection vulnerability in the getStringParameterSQL method in… CVSS 3.1CRITICAL 9.8
  • TI-2013-01952 The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1… CVSS 2.0HIGH 7.5
  • TI-2013-01934 ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss… CVSS 2.0HIGH 7.5
  • TI-2012-00809 The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss… CVSS 2.0MEDIUM 6.8
  • TI-2015-00219 XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion… CVSS 2.0MEDIUM 6.4
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences