CVE-2012-4550: Jboss enterprise application platform: jboss eap: jbeap: jboss enterprise application platform: unauthorized ejb access via authorization module bypass
A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers (JACC) permissions from being applied, allowing remote attackers to gain unauthorized access to EJBs.
Other sources
JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, when using role-based authorization for Enterprise Java Beans (EJB) access, does not call the intended authorization modules, which prevents JACC permissions from being applied and allows remote attackers to obtain access to the EJB.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4550?
CVE-2012-4550 is classified as a high severity vulnerability due to its potential for unauthorized remote access.
How do I fix CVE-2012-4550?
To fix CVE-2012-4550, upgrade your JBoss Enterprise Application Platform to version 6.0.1 or later.
What systems are affected by CVE-2012-4550?
CVE-2012-4550 affects JBoss Enterprise Application Platform version 6.0.0 prior to updates.
What type of attacks can CVE-2012-4550 enable?
CVE-2012-4550 could potentially allow remote attackers to bypass authorization mechanisms and gain unauthorized access.
Is there a workaround for CVE-2012-4550?
There is no known workaround for CVE-2012-4550 other than updating to a patched version.