CVE-2013-4213
MEDIUM severity · CVSS 6.4 · Improper access control
6.4CVSS MEDIUM
Summary
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impactNone
Exploit probability (EPSS)2%
AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://rhn.redhat.com/errata/RHSA-2013-1151.htmlAdvisory
- http://rhn.redhat.com/errata/RHSA-2013-1152.htmlAdvisory
- http://rhn.redhat.com/errata/RHSA-2013-1437.htmlAdvisory
- http://osvdb.org/96216
- http://secunia.com/advisories/54508
- http://www.securitytracker.com/id/1028898Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=985359
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86387