CVE-2014-7849

2015-02-1315:59:05

CWE-264

[email protected]

web.nvd.nist.gov

jboss

eap

rbac

access control

cve-2014-7849

security vulnerability

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

6.2 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

67.9%

JSON

The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer role.

Affected configurations

NVD

Node

redhatjboss_enterprise_application_platformMatch6.2.0

redhatjboss_enterprise_application_platformMatch6.2.1

redhatjboss_enterprise_application_platformMatch6.2.2

redhatjboss_enterprise_application_platformMatch6.2.3

redhatjboss_enterprise_application_platformMatch6.2.4

redhatjboss_enterprise_application_platformMatch6.3.0

redhatjboss_enterprise_application_platformMatch6.3.1

redhatjboss_enterprise_application_platformMatch6.3.2

CPENameOperatorVersion
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.2.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.2.1
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.2.2
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.2.3
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.2.4
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.3.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.3.1
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.3.2

CPE	Name	Operator	Version
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.2.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.2.1
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.2.2
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.2.3
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.2.4
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.3.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.3.1
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.3.2