CVE-2013-4112: The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attack
43
This month
MEDIUM 5.4WATCHLISTDOWNGRADEDOWNGRADE
CVE-2013-4112 is a medium-severity flaw (CVSS 5.4) affecting jgroup, jboss enterprise application platform. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.
Why this priority
On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2013-4112?
jgroup: downgrade or apply the listed mitigation; jboss enterprise application platform: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2013-4112 being exploited?
CVE-2013-4112 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2013-4112 affect?
CVE-2013-4112 affects jgroup, jboss enterprise application platform. Severity is medium (CVSS 5.4). The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.
PatchTheCVE