Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2012-4549

Overview

Vulnerability Score 5.8 5.8
CVE Id CVE-2012-4549
Last Modified 15 Jan 2013 12:00:00
Published 04 Jan 2013 07:55:02
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity MEDIUM
Authentication NONE

CVE-2012-4549

Summary

The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.

Vulnerable Systems

Application

  • Redhat Jboss Enterprise Application Platform 4.2.0

  • Redhat Jboss Enterprise Application Platform 4.3.0

  • Redhat Jboss Enterprise Application Platform 5.0.0

  • Redhat Jboss Enterprise Application Platform 5.0.1

  • Redhat Jboss Enterprise Application Platform 5.1.0

  • Redhat Jboss Enterprise Application Platform 5.1.1

  • Redhat Jboss Enterprise Application Platform 5.1.2

  • Redhat Jboss Enterprise Application Platform 5.2.0

  • Redhat Jboss Enterprise Application Platform 5.2.1

  • Redhat Jboss Enterprise Application Platform 5.2.2

  • Redhat Jboss Enterprise Application Platform 6.0.0

  • Redhat Jboss Enterprise Application Platform 6.0.1


References

SECUNIA - 51607

REDHAT - RHSA-2012:1594

REDHAT - RHSA-2012:1592

REDHAT - RHSA-2012:1591


Last Updated: 27 May 2016 10:56:40