Description

The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2013-1207.html

http://rhn.redhat.com/errata/RHSA-2013-1208.html

http://rhn.redhat.com/errata/RHSA-2013-1209.html

http://rhn.redhat.com/errata/RHSA-2013-1437.html

http://rhn.redhat.com/errata/RHSA-2013-1771.html

http://rhn.redhat.com/errata/RHSA-2014-0029.html

https://bugzilla.redhat.com/show_bug.cgi?id=983489

Related Vulnerabilities

CVE-2020-28482 Vulnerability in npm package fastify-csrf

CVE-2017-1000113 Vulnerability in maven package org.jenkins-ci.plugins:deploy

CVE-2014-9970 Vulnerability in maven package org.jasypt:jasypt

CVE-2016-0793 Vulnerability in maven package org.wildfly:wildfly-undertow

CVE-2018-1000609 Vulnerability in maven package io.jenkins:configuration-as-code

Severity

Critical

Tags

CWE-200