CVE-2012-4549CWE-266

Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization

Medium · published January 5, 2013

CVSS v3.1
6.5
EPSS
1%
Percentile
70.0
In the wild
Unconfirmed
What it is

A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01300 · 70.0th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2013-01-05T00:00Z
EPSS history
Timeline
  • 05 JAN 00:00Z
    Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization
    cvelistv5