Skip to content
fr Sign in
Not rated

CVE-2014-0245 It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe

Description

It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer, and the endpoint in question is being used by a privileged user. This affects JBoss Portal 6.2.0.

Affected products and versions

Product Affected versions Fixed in
JBoss Portal 6.2.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of JBoss Portal

The 2 CVEs of JBoss Portal →
CVE-2012-5626 EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network… Not rated
Track this CVE