CVEvulnerability
CVE-2014-3472
4.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-08-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.9 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-264
Description
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.
Affected configurations
• redhat jboss enterprise application platform 6.3.0
Related
Weakness · not in database (1)
References
- http://rhn.redhat.com/errata/RHSA-2014-1019.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1020.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1021.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0720.html Vendor Advisory
- http://www.securityfocus.com/bid/69094 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1103815 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95170 exchange.xforce.ibmcloud.com
- http://rhn.redhat.com/errata/RHSA-2014-1019.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1020.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1021.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0720.html Vendor Advisory
- http://www.securityfocus.com/bid/69094 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1103815 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95170 exchange.xforce.ibmcloud.com