ENISA EU KEV catalog membership for CVE-2011-4085
ENISA EU KEV lists this vulnerability as known to be exploited. This is public intelligence, not a VTP sensor observation.
CVE-2011-4085
Separate evidence group
Original Vulnerability threat dossier
CVE-2011-4085
redhatjboss enterprise application platform
The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.
VTP deterministic threat36.6of 100 · CVSS excluded
VTP analyst assessment
Monitoring — no AI review currently required
AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateNOT REQUIRED
AI priorityNONE
AI confidenceUnknown
Public exploitation · VTP factCONFIRMED
Assessment
This CVE remains in monitoring. Its metadata and source evidence are available below. A new material report or relevant sensor finding can trigger an AI review.
Why it matters
The available facts and source references are listed below. No AI assessment has been recorded for this dossier.
Evidence
No validated baseline evidence scope is persisted for this CVE.
Uncertainties
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Next watchpoint
A validated functional exploit or automated exploitation capability would materially change this assessment.
AI baseline history (0)
Technical severityMEDIUMCVSS 6.8 · technical context
Public exploitationCONFIRMEDGlobal public evidence
Exploit maturityTECHNICAL DETAILSReliability not implied
EPSS0.0386th percentile · prediction
Evidence confidence95%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN01
VTP deterministic assessment
Why this matters
- 01
A primary source reports active exploitation.
- 02
EPSS is 0.03; this is predictive context, not exploitation evidence.
- 03
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
02
Material change ledger
What changed
No material changes are recorded for this subject.
03
Claim provenance
Evidence and source independence
1publications detected
1underlying evidence chains
1 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Source claimACTIVE EXPLOITATIONENISA EU KEV LISTED
95%claim confidence
INDEPENDENTcatalog:enisa-eu-kev:CVE-2011-4085ACTIVE
Evidence 04
Event history
Threat timeline
- 00:0014 JulACTIVE EXPLOITATION
ENISA EU KEV entry added
ENISA EU KEV reports known exploitation. VTP imported this historical entry as source baseline. This is public intelligence, not a VTP sensor observation.
05
Original publications
Source record
06
Technical vulnerability data
Context, not threat proof
VTP threat score36.6vtp-threat-v1-public
Public exploitation24 / 30
EPSS prediction0.59 / 20
Exploit availability2.5 / 15
Source independence7.5 / 15
Intelligence recency2 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
- CVSS
- 6.8 · MEDIUM
- Vector
- AV:N/AC:M/Au:N/C:P/I:P/A:P
- CWE
- CWE-287
- CPE records
- 26
- Deterministic history records
- 20
07
Raw observations
First-party sensor records
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.