Input validation

2013-01-0500:55:00

PRIOn knowledge base

www.prio-n.com

6.9 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

56.1%

JSON

The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.

CPENameOperatorVersion
jboss_enterprise_application_platformeq5.1.2
jboss_enterprise_application_platformeq4.3.0
jboss_enterprise_application_platformeq5.2.2
jboss_enterprise_application_platformeq5.1.1
jboss_enterprise_application_platformeq5.0.1
jboss_enterprise_application_platformeq5.1.0
jboss_enterprise_application_platformeq5.2.0
jboss_enterprise_application_platformeq5.2.1
jboss_enterprise_application_platformeq4.2.0
jboss_enterprise_application_platformle6.0.0

Name	Operator	Version
jboss_enterprise_application_platform	eq	5.1.2
jboss_enterprise_application_platform	eq	4.3.0
jboss_enterprise_application_platform	eq	5.2.2
jboss_enterprise_application_platform	eq	5.1.1
jboss_enterprise_application_platform	eq	5.0.1
jboss_enterprise_application_platform	eq	5.1.0
jboss_enterprise_application_platform	eq	5.2.0
jboss_enterprise_application_platform	eq	5.2.1
jboss_enterprise_application_platform	eq	4.2.0
jboss_enterprise_application_platform	le	6.0.0