CVE-2014-3472

Red Hat JBoss Enterprise Application Platform 6.3.0 - Authenticated Access Restriction Bypass via isCallerInRole

Title source: llm
STIX 2.1

Description

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69094
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1103815
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0720.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1020.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1021.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1019.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/95170

Scores

EPSS 0.0168
EPSS Percentile 74.5%

Details

CWE
CWE-264
Status published
Products (1)
redhat/jboss_enterprise_application_platform 6.3.0
Published Aug 19, 2014
Tracked Since Feb 18, 2026