CVE-2014-3464 — Vulnetix

Try Vulnetix Request Demo

CVE-2014-3464 PUBLISHED CVSS 5.5 MEDIUM

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.

EPSS 0.19% · 40.7th percentile

Risk Scores

CVSS v2.0

5.5

EPSS Score

0.19%

40.7th percentile

Affected Products

Vendor	Product	Versions
redhat	jboss_enterprise_application_platform	6.2.0, 6.3.0
n/a	n/a	n/a

Timeline

Aug 19, 2014 CVE Published
Feb 4, 2022 EPSS Score
Mar 28, 2022 EPSS Score
May 19, 2022 EPSS Score
Jul 10, 2022 EPSS Score
Sep 1, 2022 EPSS Score
Oct 23, 2022 EPSS Score
Dec 14, 2022 EPSS Score
Feb 4, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 28, 2023 EPSS Score
May 19, 2023 EPSS Score

References

jboss-eap-cve20143464-sec-bypass(95409) vdb
RHSA-2014:1020 vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1102317 url
RHSA-2014:1021 vendor-advisory
RHSA-2014:1019 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-3464 advisory

Open in Interactive Console →