CVE-2012-4549

Опубликовано: 05 янв. 2013

Источник: nvd

CVSS3: 6.5

CVSS2: 5.8

EPSS Низкий

Описание

A flaw was found in JBoss Enterprise Application Platform. The processInvocation function within the org.jboss.as.ejb3.security.AuthorizationInterceptor component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.

Ссылки

http://rhn.redhat.com/errata/RHSA-2012-1591.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1592.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1594.html
Vendor Advisory
http://secunia.com/advisories/51607
Vendor Advisory
https://access.redhat.com/errata/RHSA-2012:1591
https://access.redhat.com/errata/RHSA-2012:1592
https://access.redhat.com/errata/RHSA-2012:1594
https://access.redhat.com/security/cve/CVE-2012-4549
http://rhn.redhat.com/errata/RHSA-2012-1591.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1592.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1594.html
Vendor Advisory
http://secunia.com/advisories/51607
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*

Версия до 6.0.0 (включая)

cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.2:*:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.01311

Низкий

6.5 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-266

CWE-264

Связанные уязвимости

CVE-2012-4549

CVSS3: 6.5

ubuntu

больше 13 лет назад

A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.

CVE-2012-4549

CVSS3: 6.5

redhat

больше 13 лет назад

CVE-2012-4549

CVSS3: 6.5

debian

больше 13 лет назад

A flaw was found in JBoss Enterprise Application Platform. The `proces ...

GHSA-4crg-m9w3-g9fc

CVSS3: 6.5

github

около 4 лет назад

The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.

EPSS

Процентиль: 68%

0.01311

Низкий

6.5 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-266

CWE-264