CVE-2014-3472 in Red Hat JBoss Enterprise Application Platform

Sumário (Inglês)

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

Reservar

14/05/2014

Divulgação

19/08/2014

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
70657	Red Hat JBoss Enterprise Application Platform Access Restriction isCallerInRole Elevação de Privilégios	264	Não definido	Não definido	CVE-2014-3472