Published: 05/01/2013 Updated: 15/01/2013

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

Subscribe to Jboss Enterprise Application Platform

The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) prior to 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows malicious users to bypass intended access restrictions for EJB methods.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat jboss enterprise application platform 5.1.1
redhat jboss enterprise application platform 4.3.0
redhat jboss enterprise application platform 5.0.0
redhat jboss enterprise application platform 5.1.0
redhat jboss enterprise application platform 5.2.1
redhat jboss enterprise application platform 5.2.0
redhat jboss enterprise application platform 5.2.2
redhat jboss enterprise application platform 5.0.1
redhat jboss enterprise application platform 5.1.2
redhat jboss enterprise application platform 4.2.0
redhat jboss enterprise application platform

Synopsis Important: JBoss Enterprise Application Platform 601 update Type/Severity Security Advisory: Important Topic JBoss Enterprise Application Platform 601, which fixes multiple securityissues, various bugs, and adds enhancements, is now available from the RedHat Customer PortalThe Red Hat Security ...

Synopsis Important: JBoss Enterprise Application Platform 601 update Type/Severity Security Advisory: Important Topic Updated JBoss Enterprise Application Platform 601 packages that fixmultiple security issues, various bugs, and add enhancements are nowavailable for Red Hat Enterprise Linux 5The Red Ha ...

Synopsis Important: JBoss Enterprise Application Platform 601 update Type/Severity Security Advisory: Important Topic Updated JBoss Enterprise Application Platform 601 packages that fixmultiple security issues, various bugs, and add enhancements are nowavailable for Red Hat Enterprise Linux 6The Red Ha ...

CWE-264 http://secunia.com/advisories/51607 http://rhn.redhat.com/errata/RHSA-2012-1594.html http://rhn.redhat.com/errata/RHSA-2012-1591.html http://rhn.redhat.com/errata/RHSA-2012-1592.html https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2012:1594

CVE-2012-4549

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect