CVE-2012-0874

CVE-2012-0874 describes an authentication bypass vulnerability in the JMXInvokerHAServlet and EJBInvokerHAServlet invoker servlets within several Red Hat JBoss Enterprise products, including Application Platform, Web Platform, BRMS Platform, and SOA Platform versions prior to 5.2.0 or 5.3.1. By default, these servlets lack proper authentication in certain configurations, potentially allowing unauthenticated remote attackers to invoke MBean methods and execute arbitrary code. With a CVSS score of 6.8, this vulnerability is considered medium severity, requiring medium attack complexity (AC:M) but no authentication (Au:N) for network-based exploitation (AV:N). Successful exploitation could lead to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). The FAUCET Risk Score of 98/100 indicates a high overall risk. While not listed on the KEV catalog, exploit code for a related vulnerability (EDB-30211) targeting EMC Data Protection Advisor's EJBInvokerServlet exists on ExploitDB. The vulnerability has garnered significant community discussion and media coverage, suggesting awareness and potential for exploitation, though no Metasploit or Nuclei modules are publicly available.