CVE-2012-3428
The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource connection in opportunistic circumstances via an invalid connection attempt.
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-255
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jboss:ironjacamar
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ppg2-ww3w-hq84 | Maven | org.jboss.ironjacamar:ironjacamar-jdbc | <1.0.12.Final | 1.0.12.Final |