User confusion in IronJacamar
Moderate severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Dec 18, 2023
Package
Affected versions
< 1.0.12.Final
Patched versions
1.0.12.Final
Description
Published by the National Vulnerability Database
Dec 20, 2012
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Dec 18, 2023
Last updated
Dec 18, 2023
Credits
-
q5438722 Analyst
The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource connection in opportunistic circumstances via an invalid connection attempt.
References