Read the docs
TI-2014-00237 Aliases CVE-2014-0245GHSA-4xc9-63p3-pjqr

Race condition in Red Hat JBoss Portal

Priority LOW 28CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer, and the endpoint in question is being used by a privileged user. This affects JBoss Portal 6.2.0.

Why it matters now

EPSS 0.01015 63rd percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatJBoss Portal6.2.0—No fix listedCNA
  • JBoss Portal VendorRed Hat Affected 6.2.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_portal:6.2.0:*:*:*:*:*:*:*6.2.0VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_portal:6.2.0:*:*:*:*:*:*:* Versions 6.2.0 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2015:1009 Released 2015-05-14 · Red Hat rating Important
    Red Hat JBoss Portal 6.2.0 update
    • Red Hat JBoss Portal 6.2

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Portal 6.2Fixed RHSA-2015:1009

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0245
  2. 2026-10-03 Alias added: GHSA-4xc9-63p3-pjqr

References

Advisory 3

  • TI-2015-06239 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data… CVSS 3.0CRITICAL 9.8
  • TI-2012-04729 EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red… CVSS 3.1HIGH 7.5
  • TI-2011-02179 Broken or risky cryptographic algorithm in Apache WSS4J CVSS 3.1MEDIUM 5.9
  • TI-2015-04344 The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0… CVSS 2.0MEDIUM 5.8
  • TI-2013-05444 JBossWeb Bayeux has reflected XSS CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences