CVE-2014-0245

Katalog CVE

CVSS 5.9 · Medium EPSS 1,0%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada redhat jboss portal. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer, and the endpoint in question is being used by a privileged user. This affects JBoss Portal 6.2.0.

Rincian

Terbit di NVD

2 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2015:1009 advisory vendor
• https://access.redhat.com/security/cve/cve-2014-0245 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0245 issue tracking · advisory vendor