CVE-2005-4709
Severity:
Pending analysis
Type:
Unavailable / Other
Publication date:
31/12/2005
Last modified:
20/07/2017
Description
The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans (EJB) 3.0 RC3 maintains the threadPrincipal and threadCredential values from a previous client's authentication after termination of a client session, which allows remote attackers to gain the roles of an arbitrary previous client who had the same JBoss server thread.
Impact
Base Score 2.0
5.00
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:jboss:enterprise_java_beans:3.0_rc3:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page