CVE-2012-4549: Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization
A flaw was found in JBoss Enterprise Application Platform. The processInvocation function within the org.jboss.as.ejb3.security.AuthorizationInterceptor component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.
Other sources
The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4549?
CVE-2012-4549 is considered a critical vulnerability due to the potential for unauthorized access to EJB methods.
How do I fix CVE-2012-4549?
To fix CVE-2012-4549, upgrade your JBoss Enterprise Application Platform to a version that is 6.0.1 or above.
What systems are affected by CVE-2012-4549?
CVE-2012-4549 affects various versions of Red Hat JBoss Enterprise Application Platform, including versions up to 6.0.0 and specific older versions.
What type of vulnerability is CVE-2012-4549?
CVE-2012-4549 is an authorization bypass vulnerability that affects the processInvocation function in the AuthorizationInterceptor.
How can attackers exploit CVE-2012-4549?
Attackers can exploit CVE-2012-4549 by making unauthorized requests to EJB method invocations when no roles are required.