Input validation

2013-12-0617:55:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.2%

JSON

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.

CPENameOperatorVersion
enterprise_linuxeq6.0
enterprise_linuxeq5
jboss_enterprise_application_platformeq4.2.0 cp9
jboss_enterprise_application_platformeq6.0.1
jboss_enterprise_application_platformeq4.3.0 cp10
jboss_enterprise_application_platformeq5.1.2
jboss_enterprise_application_platformeq4.3.0
jboss_enterprise_application_platformeq6.0.0
jboss_enterprise_application_platformeq5.2.2
jboss_enterprise_application_platformeq5.1.1

Name	Operator	Version
enterprise_linux	eq	6.0
enterprise_linux	eq	5
jboss_enterprise_application_platform	eq	4.2.0 cp9
jboss_enterprise_application_platform	eq	6.0.1
jboss_enterprise_application_platform	eq	4.3.0 cp10
jboss_enterprise_application_platform	eq	5.1.2
jboss_enterprise_application_platform	eq	4.3.0
jboss_enterprise_application_platform	eq	6.0.0
jboss_enterprise_application_platform	eq	5.2.2
jboss_enterprise_application_platform	eq	5.1.1