Описание
A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers (JACC) permissions from being applied, allowing remote attackers to gain unauthorized access to EJBs.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Enterprise Application Platform 7 | org.jboss.eap-jboss-eap-parent | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | org.jboss.eap-jboss-eap-parent | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | org.jboss.eap-jboss-eap-parent | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 6.0 | Fixed | RHSA-2012:1594 | 18.12.2012 | |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | antlr-eap6 | Fixed | RHSA-2012:1591 | 18.12.2012 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | apache-commons-beanutils | Fixed | RHSA-2012:1591 | 18.12.2012 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | apache-commons-cli | Fixed | RHSA-2012:1591 | 18.12.2012 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | apache-commons-codec-eap6 | Fixed | RHSA-2012:1591 | 18.12.2012 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | apache-commons-collections | Fixed | RHSA-2012:1591 | 18.12.2012 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | apache-commons-collections-eap6 | Fixed | RHSA-2012:1591 | 18.12.2012 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers (JACC) permissions from being applied, allowing remote attackers to gain unauthorized access to EJBs.
A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers (JACC) permissions from being applied, allowing remote attackers to gain unauthorized access to EJBs.
A flaw was found in JBoss Enterprise Application Platform. When role-b ...
JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, when using role-based authorization for Enterprise Java Beans (EJB) access, does not call the intended authorization modules, which prevents JACC permissions from being applied and allows remote attackers to obtain access to the EJB.
EPSS
5.3 Medium
CVSS3