Описание
A flaw was found in JBoss Enterprise Application Platform. The processInvocation function within the org.jboss.as.ejb3.security.AuthorizationInterceptor component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Enterprise Application Platform 7 | org.jboss.eap-jboss-eap-parent | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | org.jboss.eap-jboss-eap-parent | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | org.jboss.eap-jboss-eap-parent | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 6.0 | Fixed | RHSA-2012:1594 | 18.12.2012 | |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | antlr-eap6 | Fixed | RHSA-2012:1591 | 18.12.2012 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | apache-commons-beanutils | Fixed | RHSA-2012:1591 | 18.12.2012 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | apache-commons-cli | Fixed | RHSA-2012:1591 | 18.12.2012 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | apache-commons-codec-eap6 | Fixed | RHSA-2012:1591 | 18.12.2012 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | apache-commons-collections | Fixed | RHSA-2012:1591 | 18.12.2012 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | apache-commons-collections-eap6 | Fixed | RHSA-2012:1591 | 18.12.2012 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.
A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.
A flaw was found in JBoss Enterprise Application Platform. The `proces ...
The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.
EPSS
6.5 Medium
CVSS3