CVE-2012-4550
MEDIUM severity · CVSS 5.3 · CWE-280
5.3CVSS MEDIUM
Summary
A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers (JACC) permissions from being applied, allowing remote attackers to gain unauthorized access to EJBs.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactLow
Integrity impactNone
Availability impactNone
Exploit probability (EPSS)2%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://rhn.redhat.com/errata/RHSA-2012-1591.htmlAdvisory
- http://rhn.redhat.com/errata/RHSA-2012-1592.htmlAdvisory
- http://rhn.redhat.com/errata/RHSA-2012-1594.htmlAdvisory
- http://secunia.com/advisories/51607Advisory
- https://access.redhat.com/errata/RHSA-2012:1591
- https://access.redhat.com/errata/RHSA-2012:1592
- https://access.redhat.com/errata/RHSA-2012:1594
- https://access.redhat.com/security/cve/CVE-2012-4550