JBoss AS may expose root content if excluded-contexts list is mismatched

ÉLEVÉE 7.5CVE-2012-1094 · GHSA-wq8g-hm94-5rqq · Published 10/03/2020 · updated 16/06/2026

En bref

CVE-2012-1094 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant org.jboss.as:jboss-as-server, jboss application server (redhat).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.1%, plus élevée que 65.8% des vulnérabilités.
Correctif : mettre à jour vers 7.1.1.Final, 7.1.1 ou plus récent.

Package	Affected versions	Patched versions
org.jboss.as:jboss-as-server Maven	`≥ 7.0.0.Alpha1, < 7.1.1.Final`	`7.1.1.Final`
jboss application server redhat	`≥ 7.0.0, < 7.1.1`	`7.1.1`

Description

JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.

NVD description

JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.

References

nvd.nist.gov/vuln/detail/CVE-2012-1094 · ADVISORY
access.redhat.com/security/cve/cve-2012-1094 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free