CVE-2012-4549 in Red Hat JBoss Enterprise Application Platform
Summary
The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.
Reservation
08/21/2012
Disclosure
01/04/2013
Entries
VulDB provides additional information and datapoints for this CVE: