CVEvulnerability

CVE-2012-4549

6.5 MEDIUM Published 2013-01-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-01-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-264, CWE-266

Description

A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.

Affected configurations

• redhat jboss enterprise application platform (<= 6.0.0) • redhat jboss enterprise application platform 4.2.0 • redhat jboss enterprise application platform 4.3.0 • redhat jboss enterprise application platform 5.0.0 • redhat jboss enterprise application platform 5.0.1 • redhat jboss enterprise application platform 5.1.0 • redhat jboss enterprise application platform 5.1.1 • redhat jboss enterprise application platform 5.1.2 • redhat jboss enterprise application platform 5.2.0 • redhat jboss enterprise application platform 5.2.1 • redhat jboss enterprise application platform 5.2.2

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-266 Incorrect Privilege Assignment weakness

References