CVE-2014-0018: Low severity redhat JBoss Enterprise Application Platform vulnerability
IssueDescription:
In Red Hat JBoss Enterprise Application Platform, when running under a security manager, it was possible for deployed code to get access to the Modular Service Container (MSC) service registry without any permission checks. This could allow malicious deployments to modify the internal state of the server in various ways.
Other sources
Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry, which allows local users to modify the server via a crafted deployment.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0018?
CVE-2014-0018 is considered a medium-level vulnerability due to the potential for unauthorized code to access sensitive registry components.
How do I fix CVE-2014-0018?
To fix CVE-2014-0018, it is recommended to upgrade to a version of Red Hat JBoss that includes security updates addressing this vulnerability.
Which software versions are affected by CVE-2014-0018?
CVE-2014-0018 affects Red Hat JBoss Enterprise Application Platform version 6.2.0 and the Red Hat JBoss WildFly Application Server.
What impact does CVE-2014-0018 have on application security?
CVE-2014-0018 may allow malicious code to modify the Modular Service Container service registry without proper permission checks, compromising application security.
Is CVE-2014-0018 related to security manager configurations?
Yes, CVE-2014-0018 specifically occurs when running Red Hat JBoss under a security manager, where permission checks are bypassed.