CVE-2012-4549
Medium
Description
A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Redhat Jboss Enterprise Application Platform
PublishedJan 5, 2013
First seenJan 5, 2013
Weakness typeCWE-266CWE-266
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat jboss_enterprise_application_platform | v ≤ 6.0.0, 4.2.0, 4.3.0, 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.1.2, 5.2.0, 5.2.1, 5.2.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.