Vulnerability Name:

CVE-2014-8122 (CCN-100892)

Assigned:2014-10-10
Published:2015-02-11
Updated:2017-09-08
Summary:Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-362
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2014-8122

Source: CCN
Type: RHSA-2015-0215
Moderate: Red Hat JBoss Enterprise Application Platform 6.3.3 update

Source: REDHAT
Type: Vendor Advisory
RHSA-2015:0215

Source: REDHAT
Type: Vendor Advisory
RHSA-2015:0216

Source: REDHAT
Type: Vendor Advisory
RHSA-2015:0217

Source: REDHAT
Type: Vendor Advisory
RHSA-2015:0218

Source: REDHAT
Type: UNKNOWN
RHSA-2015:0675

Source: REDHAT
Type: UNKNOWN
RHSA-2015:0773

Source: REDHAT
Type: UNKNOWN
RHSA-2015:0850

Source: REDHAT
Type: UNKNOWN
RHSA-2015:0851

Source: REDHAT
Type: UNKNOWN
RHSA-2015:0920

Source: CCN
Type: SECTRACK ID: 1031741
Red Hat JBoss Enterprise Application Platform Bugs Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticated Users Bypass Security Controls

Source: CCN
Type: Red Hat Web site
JBoss Enterprise Application Platform

Source: BID
Type: UNKNOWN
74252

Source: CCN
Type: BID-74252
Red Hat JBoss Weld CVE-2014-8122 Information Disclosure Vulnerability

Source: SECTRACK
Type: UNKNOWN
1031741

Source: XF
Type: UNKNOWN
redhat-jboss-cve20148122-info-disc(100892)

Source: XF
Type: UNKNOWN
redhat-jboss-cve20148122-info-disc(100892)

Source: MISC
Type: UNKNOWN
https://github.com/victims/victims-cve-db/blob/master/database/java/2014/8122.yaml

Source: CONFIRM
Type: UNKNOWN
https://github.com/weld/core/commit/29fd1107fd30579ad9bb23fae4dc3ba464205745

Source: CONFIRM
Type: UNKNOWN
https://github.com/weld/core/commit/6808b11cd6d97c71a2eed754ed4f955acd789086

Source: CONFIRM
Type: UNKNOWN
https://github.com/weld/core/commit/8e413202fa1af08c09c580f444e4fd16874f9c65

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-8122

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:jboss_weld:*:*:*:*:*:*:*:* (Version <= 2.2.7)
  • OR cpe:/a:redhat:jboss_weld:3.0.0:alpha1:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_weld:3.0.0:alpha2:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:redhat:jboss_enterprise_application_platform:6.3.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    redhat jboss weld *
    redhat jboss weld 3.0.0 alpha1
    redhat jboss weld 3.0.0 alpha2
    redhat jboss enterprise application platform 6.3.3