CVE-2012-2377

Severity: low (CVSS 3.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-11-23 · updated 2026-06-16
Weakness: CWE-287

Description

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast.

Affected products

RedHat Jboss Enterprise Brms Platform: through 5.2.0
RedHat Jboss Enterprise Portal Platform: through 5.2.1; 4.3.0, 4.3.0-cp07, 5.0.0, 5.0.1, 5.1.0, 5.1.1 (+1)
RedHat Jboss Enterprise Soa Platform: through 5.2.0; 4.2.0, 4.2.0-cp01, 4.2.0-cp02, 4.2.0-cp03, 4.2.0-cp04, 4.2.0-cp05 (+12)

References

Get alerted when CVE-2012-2377 or the next vulnerability affects your stack