GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2007-1354

Vulnerability from fkie_nvd - Published: 2007-07-27 21:30 - Updated: 2026-06-16 22:37
Severity
Summary
The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by logging in during a session by a more privileged administrator, as demonstrated by privilege escalation from Read Mode to Write Mode.
References
secalert@redhat.comhttp://jira.jboss.com/jira/browse/ASPATCH-172Patch
secalert@redhat.comhttp://jira.jboss.com/jira/browse/ASPATCH-175Patch
secalert@redhat.comhttp://osvdb.org/46765
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2007-0151.htmlPatch
secalert@redhat.comhttp://www.redhat.com/archives/jboss-watch-list/2007-April/msg00000.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://jira.jboss.com/jira/browse/ASPATCH-172Patch
af854a3a-2127-422b-91ae-364da2661108http://jira.jboss.com/jira/browse/ASPATCH-175Patch
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/46765
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2007-0151.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/archives/jboss-watch-list/2007-April/msg00000.htmlPatch
Impacted products
Vendor Product Version
jboss jboss_application_server 4.0.2.ga_cp02
jboss jboss_application_server 4.0.2.ga_cp03
jboss jboss_application_server 4.0.2.ga_cp04
jboss jboss_application_server 4.0.5.ga
jboss jboss_application_server 4.0.5_cp01
jboss jboss_application_server 4.0.5_cp02
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jboss:jboss_application_server:4.0.2.ga_cp02:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7035F76-F6FF-477D-91F4-1663F2008699",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jboss:jboss_application_server:4.0.2.ga_cp03:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D882D74-F526-404D-9BB3-88DC3D355FBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jboss:jboss_application_server:4.0.2.ga_cp04:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EAE9B8C-A1BE-42C8-9682-216D27AF7146",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jboss:jboss_application_server:4.0.5.ga:*:*:*:*:*:*:*",
              "matchCriteriaId": "2559DFD5-A230-467E-A720-7AE7FA9309CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jboss:jboss_application_server:4.0.5_cp01:*:*:*:*:*:*:*",
              "matchCriteriaId": "DABC5FBF-A500-4A80-885B-FBEACFB7393E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jboss:jboss_application_server:4.0.5_cp02:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3F772B0-5BC2-4AE4-AEA7-F22375039025",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by logging in during a session by a more privileged administrator, as demonstrated by privilege escalation from Read Mode to Write Mode."
    },
    {
      "lang": "es",
      "value": "La funcionalidad Control de Acceso (JMXOpsAccessControlFilter) en JMX Console de JBoss Application Server 4.0.2 y 4.0.5 versiones anteriores a 20070416 utiliza una variable miembro para almacenar los roles del usuario actual, lo cual permite a administradores remotos autenticados disparar una condici\u00f3n de carrera y obtener privilegios al identificarse en una sesi\u00f3n, por los de otro administrador con m\u00e1s privilegios, como se demuestra con un escalado de privilegios de Modo Lectura a Modo Escritura."
    }
  ],
  "id": "CVE-2007-1354",
  "lastModified": "2026-06-16T22:37:24.840",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": true,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-07-27T21:30:00.000",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://jira.jboss.com/jira/browse/ASPATCH-172"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://jira.jboss.com/jira/browse/ASPATCH-175"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/46765"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2007-0151.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://www.redhat.com/archives/jboss-watch-list/2007-April/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://jira.jboss.com/jira/browse/ASPATCH-172"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://jira.jboss.com/jira/browse/ASPATCH-175"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/46765"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2007-0151.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.redhat.com/archives/jboss-watch-list/2007-April/msg00000.html"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.