CVE-2012-3428

CVE-2012-3428 describes a vulnerability in IronJacamar containers prior to version 1.0.12.Final, used with JBoss Application Server. When the "allow-multiple-users" option is enabled alongside a security domain, the container fails to properly utilize credentials provided during a getConnection call. This flaw allows remote attackers to gain unauthorized access to arbitrary datasource connections under specific conditions, even with invalid connection attempts. The vulnerability has a CVSS score of 4.3, indicating a medium attack complexity and potential for partial integrity impact, but no confidentiality or availability impact. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.