CVE-2012-3370: The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, W...

Security readout for executives and security teams

This is an old JBoss/Red Hat platform flaw where an application can receive the previous user's credentials when no security context is supplied. In affected deployments, a remote attacker could be treated as another user, creating privilege escalation and data exposure risk. It matters most where legacy JBoss platforms remain reachable. Exposure is likely limited to legacy Red Hat JBoss EAP, EWP, BRMS Platform, or SOA Platform deployments below the named fixed versions. The bundle's structured affected list is incomplete, so asset confirmation should rely on installed product/version evidence and vendor advisories. Prioritize remediation for any reachable legacy JBoss deployment because the stated impact is cross-user credential exposure and privilege gain. Urgency is lower where the affected products are retired, isolated, or already above fixed versions. Mitigation focus: Identify affected JBoss EAP, EWP, BRMS, and SOA Platform instances.; Upgrade to the fixed versions named in the CVE description or later.; Apply the relevant Red Hat security advisory updates for your product line..

Prepared

Jun 15, 2026, 04:24 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.