CVE-2007-1354 - CVE House
Back to Database
Status published Medium CVE-2007-1354

The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss...

Vulnerability Description

The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by logging in during a session by a more privileged administrator, as demonstrated by privilege escalation from Read Mode to Write Mode.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-1354

Credits & Attribution

No credits recorded in the NVD database.

References

More from jboss

View All →
CVE-2016-8656
Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to...
High 7
CVE-2016-2094
The HTTPS NIO Connector allows remote attackers to cause a...
High 7.5
CVE-2012-3428
The IronJacamar container before 1.0.12.Final for JBoss Application Server, when...
Medium 4.3
CVE-2008-3273
JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03,...
Medium 5
CVE-2007-6433
The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam...
High 7.5

Affected Vendor

Affected Software

jboss application server
Vulnerable Versions:
4.0.2.ga_cp02, 4.0.2.ga_cp03, 4.0.2.ga_cp04, 4.0.5.ga, 4.0.5_cp01, 4.0.5_cp02

Timeline

Official Publish: July 27th, 2007
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.