CVE-2014-3472: Medium severity jboss enterprise application platform vulnerability
IssueDescription:
It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.
Other sources
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3472?
CVE-2014-3472 has a medium severity rating.
How do I fix CVE-2014-3472?
To fix CVE-2014-3472, upgrade to Red Hat JBoss Enterprise Application Platform version 6.3.1 or later.
Who is affected by CVE-2014-3472?
CVE-2014-3472 affects users of Red Hat JBoss Enterprise Application Platform version 6.3.0.
What type of vulnerability is CVE-2014-3472?
CVE-2014-3472 is a security vulnerability that involves improper role checks in access control.
What exploit can result from CVE-2014-3472?
CVE-2014-3472 could allow a remote, authenticated attacker to bypass role checks and gain unauthorized access.