CVEvulnerability

CVE-2013-2133

5.5 MEDIUM Published 2013-12-06 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-12-06
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
Weaknesses
CWE-264

Description

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.

Affected configurations

• redhat jboss enterprise application platform (<= 6.1.0) • redhat jboss enterprise application platform 4.2.0 • redhat jboss enterprise application platform 4.3.0 • redhat jboss enterprise application platform 5.0.0 • redhat jboss enterprise application platform 5.0.1 • redhat jboss enterprise application platform 5.1.0 • redhat jboss enterprise application platform 5.1.1 • redhat jboss enterprise application platform 5.1.2 • redhat jboss enterprise application platform 5.2.0 • redhat jboss enterprise application platform 5.2.1 • redhat jboss enterprise application platform 5.2.2 • redhat jboss enterprise application platform 6.0.0 • redhat jboss enterprise application platform 6.0.1 • redhat enterprise linux 5 • redhat enterprise linux 6.0

Related

Weakness · not in database (1)

References