CVE-2011-4085

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-11-23 · updated 2026-06-16
Weakness: CWE-287

Description

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.

Affected products

Red Hat JBoss EAP: through 5.1.1; 4.2.0, 4.3.0, 5.0.0, 5.0.1, 5.1.0
RedHat Jboss Enterprise Brms Platform: through 5.2.0
RedHat Jboss Enterprise Portal Platform: through 4.3.0
RedHat Jboss Enterprise Soa Platform: through 5.1.1; 4.2.0, 4.2.0-cp01, 4.2.0-cp02, 4.2.0-cp03, 4.2.0-cp04, 4.2.0-cp05 (+11)

References

Get alerted when CVE-2011-4085 or the next vulnerability affects your stack