By default, CS-MARS installs jboss without password. The jmx-console is accessible via ports 80 and 443 without authentication, which could allow an attacker to execute arbitrary code on the system.
Classification
Location:
Remote / Network Access
Attack Type:
Authentication Management
Impact:
Loss of Integrity
Exploit:
Exploit Public,
Exploit Commercial
OSVDB:
Web Related,
Security Software
Solution
Upgrade to version 4.2.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
spoofed.org -
