{"api_version":"1","generated_at":"2026-07-23T06:39:47+00:00","cve":"CVE-2012-1154","urls":{"html":"https://cve.report/CVE-2012-1154","api":"https://cve.report/api/cve/CVE-2012-1154.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-1154","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-1154"},"summary":{"title":"CVE-2012-1154","description":"mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when \"ROOT\" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.","state":"PUBLISHED","assigner":"redhat","published_at":"2012-10-22 23:55:05","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2012-1012.html","name":"http://rhn.redhat.com/errata/RHSA-2012-1012.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://community.jboss.org/message/624018","name":"https://community.jboss.org/message/624018","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"ROOT ignored in excludedContexts| JBoss.org Content Archive (Read Only)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1010.html","name":"http://rhn.redhat.com/errata/RHSA-2012-1010.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/49636","name":"http://secunia.com/advisories/49636","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Advisory SA49636 - Red Hat update for JBoss Enterprise Products - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1052.html","name":"http://rhn.redhat.com/errata/RHSA-2012-1052.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1011.html","name":"http://rhn.redhat.com/errata/RHSA-2012-1011.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1053.html","name":"http://rhn.redhat.com/errata/RHSA-2012-1053.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=802200","name":"https://bugzilla.redhat.com/show_bug.cgi?id=802200","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"802200 – (CVE-2012-1154) CVE-2012-1154 mod_cluster registers and exposes the root context of a server by default, despite ROOT being in the excluded-contexts list","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1166.html","name":"http://rhn.redhat.com/errata/RHSA-2012-1166.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://issues.jboss.org/browse/MODCLUSTER-253","name":"https://issues.jboss.org/browse/MODCLUSTER-253","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[MODCLUSTER-253] ROOT in excludedContexts doesn't work - Red Hat Issue Tracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-1154","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-1154","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"1154","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"jboss_enterprise_application_platform","cpe6":"5.1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"1154","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"mod_cluster","cpe6":"1.0.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"1154","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"mod_cluster","cpe6":"1.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"1154","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"mod_cluster","cpe6":"1.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"1154","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"mod_cluster","cpe6":"1.1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"1154","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"mod_cluster","cpe6":"1.1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"1154","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"mod_cluster","cpe6":"1.1.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T18:45:27.439Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"RHSA-2012:1012","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1012.html"},{"name":"RHSA-2012:1166","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1166.html"},{"name":"RHSA-2012:1052","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1052.html"},{"name":"RHSA-2012:1053","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1053.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://issues.jboss.org/browse/MODCLUSTER-253"},{"name":"49636","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/49636"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=802200"},{"name":"RHSA-2012:1010","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1010.html"},{"name":"RHSA-2012:1011","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1011.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://community.jboss.org/message/624018"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when \"ROOT\" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2012-10-22T23:00:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"RHSA-2012:1012","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1012.html"},{"name":"RHSA-2012:1166","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1166.html"},{"name":"RHSA-2012:1052","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1052.html"},{"name":"RHSA-2012:1053","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1053.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://issues.jboss.org/browse/MODCLUSTER-253"},{"name":"49636","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/49636"},{"tags":["x_refsource_MISC"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=802200"},{"name":"RHSA-2012:1010","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1010.html"},{"name":"RHSA-2012:1011","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1011.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://community.jboss.org/message/624018"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2012-1154","datePublished":"2012-10-22T23:00:00.000Z","dateReserved":"2012-02-14T00:00:00.000Z","dateUpdated":"2024-08-06T18:45:27.439Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-10-22 23:55:05","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*","matchCriteriaId":"8A785F07-9B76-4153-B676-29C9682B2F73"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:mod_cluster:1.0.10:*:*:*:*:*:*:*","matchCriteriaId":"75DEA77E-C3CC-4D2A-8658-66BCFC266072"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:mod_cluster:1.1.0:*:*:*:*:*:*:*","matchCriteriaId":"0BBF0B4A-581D-4672-8227-7F7F868BD4BB"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:mod_cluster:1.1.1:*:*:*:*:*:*:*","matchCriteriaId":"1087E95A-1074-4559-96E9-9AEA9DAE5D4A"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:mod_cluster:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"63AD8AB1-08DA-4377-86F0-1C45799E4331"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:mod_cluster:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"09AEE628-4C95-4FEC-8BB6-426333863192"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:mod_cluster:1.1.4:*:*:*:*:*:*:*","matchCriteriaId":"6675C75D-159C-461F-BDA9-5FA45F0792E4"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"1154","Ordinal":"1","Title":"CVE-2012-1154","CVE":"CVE-2012-1154","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"1154","Ordinal":"1","NoteData":"mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when \"ROOT\" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.","Type":"Description","Title":"CVE-2012-1154"},{"CveYear":"2012","CveId":"1154","Ordinal":"2","NoteData":"2012-10-22","Type":"Other","Title":"Published"}]}}}