{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-12-05T00:00:00", "descriptions": [{"lang": "en", "value": "Red Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce \"modify resource\" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-04-01T00:57:00", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=760024"}, {"name": "RHSA-2012:0089", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2012-0089.html"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T00:09:18.879Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=760024"}, {"name": "RHSA-2012:0089", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2012-0089.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2011-4573", "datePublished": "2014-04-01T01:00:00", "dateReserved": "2011-11-29T00:00:00", "dateUpdated": "2024-08-07T00:09:18.879Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_operations_network:*:*:*:*:*:*:*:*", "matchCriteriaId": "87E50BCC-4B27-43F7-8AB3-EC27297C4B2C", "versionEndIncluding": "2.4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "DC1625FD-302E-457E-BDD1-977DE614CB47", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "D29DC3CE-E782-47F7-BDF4-4AB63728F05B", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "DF4A10F6-2128-4986-8A28-BD9B679D8380", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "3B720DED-23EE-4830-9C8B-441A38DAE80E", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.2:*:*:*:*:*:*:*", "matchCriteriaId": "0FD44168-A91A-4043-8C34-7A20DC2C1A19", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.3:*:*:*:*:*:*:*", "matchCriteriaId": "66926B59-4A4F-47B9-9B2B-3D8DC698BC97", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "D72DFB62-EEA6-4126-9DC3-B191CC8D0CA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_operations_network:2.4:*:*:*:*:*:*:*", "matchCriteriaId": "B8DBE132-2A98-40C6-947F-50C1D06DDFB1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Red Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce \"modify resource\" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail."}, {"lang": "es", "value": "Red Hat JBoss Operations Network (JON) anterior a 2.4.2 no fuerza debidamente permisos de modificar recurso para usuarios remotos autenticados cuando elimina una actualizaci\u00f3n de configuraci\u00f3n de plugin del historial de propiedades de conexi\u00f3n de grupo, lo que previene tales actividades de ser registradas en el registro de auditor\u00eda."}], "id": "CVE-2011-4573", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-04-01T06:35:52.497", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-0089.html"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=760024"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-0089.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=760024"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2012:0089", "cpe": "cpe:/a:redhat:jboss_operations_network:2.4", "product_name": "Red Hat JBoss Operations Network 2.4", "release_date": "2012-02-01T00:00:00Z"}], "bugzilla": {"description": "JON: Incorrect delete permissions check", "id": "760024", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=760024"}, "csaw": false, "cvss": {"cvss_base_score": "3.5", "cvss_scoring_vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "status": "verified"}, "details": ["Red Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce \"modify resource\" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail."], "name": "CVE-2011-4573", "package_state": [{"cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:5", "fix_state": "Not affected", "package_name": "Security", "product_name": "Red Hat JBoss BRMS 5"}], "public_date": "2011-12-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2011-4573\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-4573"], "threat_severity": "Low"}