{"cve":"CVE-2012-0874","nvd":{"published":"2013-02-05T23:55:01.380","modified":"2026-06-16T23:38:25.870","status":"Modified","description":"The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors.  NOTE: this issue can only be exploited when the interceptor is not properly configured with a \"second layer of authentication,\" or when used in conjunction with other vulnerabilities that bypass this second layer.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-287"],"references":["http://archives.neohapsis.com/archives/bugtraq/2013-12/0134.html","http://rhn.redhat.com/errata/RHSA-2013-0191.html","http://rhn.redhat.com/errata/RHSA-2013-0192.html","http://rhn.redhat.com/errata/RHSA-2013-0193.html","http://rhn.redhat.com/errata/RHSA-2013-0194.html"],"products":["redhat:jboss_enterprise_application_platform","redhat:jboss_enterprise_brms_platform","redhat:jboss_enterprise_web_platform"],"source":"nvd","synced_at":"2026-10-19T20:27:27.940201468+00:00"},"epss":{"cve":"CVE-2012-0874","score":0.15561,"percentile":0.96834,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}