{"id":"CVE-2012-0874","published":"2013-02-05T23:11:00Z","modified":"2024-08-06T18:38:14Z","title":"The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors.  NOTE: this issue can only be exploited when the interceptor is not properly configured with a \"second layer of authentication,\" or when used in conjunction with other vulnerabilities that bypass this second layer.","provenance":"source","from":"CVE.org"},"summary":{"text":"The JMXInvokerHAServlet and EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform, Web Platform, BRMS Platform and SOA Platform do not require authentication by default in certain profiles. Exploitation requires that the interceptor lacks a properly configured second layer of authentication, or that another vulnerability is used to bypass that layer, and would let a remote attacker invoke MBean methods and execute arbitrary code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:52Z"},"cvss":null,"epss":{"score":0.15561,"percentile":0.96822,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2018-03-28","exploitedFirstSeen":"2018-03-28","ransomware":true,"evidence":[{"url":"https://www.tenable.com/blog/samsam-ransomware-how-to-identify-and-mitigate-the-risk","date":"2018-03-28"},{"url":"https://news.sophos.com/en-us/2018/05/02/shutting-out-samsam-ransomware/","date":"2018-05-02"},{"url":"https://www.securonix.com/securonix-threat-research-samsam-ransomware-detection-using-security-analytics/","date":"2018-05-15"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"VirusTotal report\n                    for Bang Bang#2.xls","url":"https://otx.alienvault.com/pulse/69b4e2ca96bf79781b0ae3bd","created":"2026-03-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-0192.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0198.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0195.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0221.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0196.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/57552","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0193.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/51984","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://securitytracker.com/id?1028042","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://secunia.com/advisories/52054","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-12/0134.html","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0191.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=795645","tags":["x_refsource_MISC"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0533.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0197.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.exploit-db.com/exploits/30211","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/81511","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0194.html","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-47d1c126a36d01f3bea4","title":"SpeakUp: A New Undetected Backdoor Linux Trojan","publisher":"research.checkpoint.com","url":"https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/","date":"2019-02-04","mentions":[{"quote":"a) CVE-2012-0874: JBoss Enterprise Application Platform Multiple Security Bypass Vulnerabilities","start":6327,"end":6423},{"quote":"File Upload(CVE-2018-2894)\n- Hadoop YARN ResourceManager Remote Command Execution\n- Apache ActiveMQ Fileserver Multi Methods Directory Traversal(CVE-2016-3088)\n- JBoss Seam 2 Framework Remote Code Execution (CVE-2010-1871)\n- JBoss Enterprise Application Platform Invoker Servlets Remote Code Execution (CVE-2012-0874)","start":10097,"end":10414}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2012-0899","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-0899","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":30211,"url":"https://www.exploit-db.com/exploits/30211","title":"EMC Data Protection Advisor DPA Illuminator - EJBInvokerServlet Remote Code Execution","type":"remote","platform":"windows","date":"2013-12-11","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2013-12-11"},"first":{"date":"2013-12-11","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/30211"},"provenance":"source"},"exploitRefs":["http://www.exploit-db.com/exploits/30211"],"flow":[{"stage":"related","techniques":["T1190"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2013-02-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2012-0874","provenance":"source"},{"date":"2013-12-11","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-30211)","url":"https://www.exploit-db.com/exploits/30211","provenance":"source"},{"date":"2018-03-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.tenable.com/blog/samsam-ransomware-how-to-identify-and-mitigate-the-risk","provenance":"source"},{"date":"2019-02-04","kind":"report","label":"Named in research.checkpoint.com: SpeakUp: A New Undetected Backdoor Linux Trojan","url":"https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/","provenance":"machine"}],"speed":{"daysToPublicExploit":309,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":73.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3137 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.36,"detail":"percentile 0.9682"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}