Vulnerability Details : CVE-2011-4573
Red Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce "modify resource" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail.
Exploit prediction scoring system (EPSS) score for CVE-2011-4573
Probability of exploitation activity in the next 30 days: 0.09%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 39 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2011-4573
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST |
CWE ids for CVE-2011-4573
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-4573
-
https://bugzilla.redhat.com/show_bug.cgi?id=760024
760024 – (CVE-2011-4573) CVE-2011-4573 JON: Incorrect delete permissions check
-
http://rhn.redhat.com/errata/RHSA-2012-0089.html
Red Hat Customer PortalVendor Advisory
Products affected by CVE-2011-4573
- cpe:2.3:a:redhat:jboss_operations_network:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_operations_network:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_operations_network:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_operations_network:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_operations_network:2.3:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_operations_network:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_operations_network:2.4:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_operations_network:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_operations_network:1.0.0:*:*:*:*:*:*:*