CVE-2014-3464: Medium severity jboss enterprise application platform vulnerability
IssueDescription:
It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke.
Other sources
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3464?
CVE-2014-3464 has a severity rating that indicates it poses a potential risk to authorized users accessing vulnerable JBoss versions.
How do I fix CVE-2014-3464?
To fix CVE-2014-3464, upgrade to the patched versions of Red Hat JBoss Enterprise Application Platform 6.2.1 or later, and 6.3.1 or later.
What versions are affected by CVE-2014-3464?
CVE-2014-3464 affects Red Hat JBoss Enterprise Application Platform versions 6.2.0 and 6.3.0.
Who is impacted by CVE-2014-3464?
CVE-2014-3464 impacts organizations using affected versions of JBoss, where remote attackers may exploit the vulnerability.
What type of vulnerability is CVE-2014-3464?
CVE-2014-3464 is a security vulnerability related to improper authorization handling in JAX-WS handlers.