Vulnetix
Try Vulnetix Request Demo
CVE-2012-4549 PUBLISHED CVSS 5.800000190734863 MEDIUM

The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.

EPSS 0.26% · 49.5th percentile

Risk Scores

CVSS v2.0
5.800000190734863
EPSS Score
0.26%
49.5th percentile

Affected Products

VendorProductVersions
redhatjboss_enterprise_application_platform5.2.2, 0, 4.2.0
n/an/an/a

Timeline

References

Open in Interactive Console →