CVE-2013-2133: Medium severity jboss enterprise application platform vulnerability
A vulnerability was identified in the way in which method-level authorization for JAX-WS Service endpoints was performed by the EJB invocation handler implementation. Any restrictions declared on EJB methods were ignored when executing the JAX-WS handlers and only class-level restrictions were applied. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler that they are not authorized to.
Other sources
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2133?
CVE-2013-2133 has a moderate severity level due to authorization issues in JAX-WS Service endpoints.
How do I fix CVE-2013-2133?
To fix CVE-2013-2133, update the JBoss Enterprise Application Platform to a version that addresses this vulnerability.
What versions of JBoss are affected by CVE-2013-2133?
CVE-2013-2133 affects multiple versions of JBoss Enterprise Application Platform, including versions up to 6.1.0 and specific lower versions.
What are the implications of CVE-2013-2133?
The implications of CVE-2013-2133 include potential bypass of method-level authorizations, possibly leading to unauthorized access to sensitive operations.
Is CVE-2013-2133 an easy vulnerability to exploit?
CVE-2013-2133 can be exploited by attackers familiar with the JAX-WS Service endpoints, making proper remediation essential.