CVE-2014-7849: Medium severity jboss enterprise application platform vulnerability
It was discovered that the Role Based Access Control (RBAC) implementation did not sufficiently verify all authorization conditions required by the Maintainer role to perform certain administrative actions. An authenticated user with the Maintainer role can use this flaw to add, modify or undefine a limited set of attributes and their values which otherwise cannot be written to.
Other sources
The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer role.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7849?
CVE-2014-7849 is classified as a medium severity vulnerability due to insufficient verification of authorization conditions.
How do I fix CVE-2014-7849?
To mitigate CVE-2014-7849, update the Red Hat JBoss Enterprise Application Platform to a version that includes the necessary patches.
Which versions of JBoss are affected by CVE-2014-7849?
CVE-2014-7849 affects Red Hat JBoss Enterprise Application Platform versions 6.2.0 through 6.3.2.
What type of vulnerability is CVE-2014-7849?
CVE-2014-7849 is an access control vulnerability that allows unauthorized actions by authenticated users with the Maintainer role.
Who is impacted by CVE-2014-7849?
Authenticated users with the Maintainer role in the affected versions of Red Hat JBoss Enterprise Application Platform are impacted by CVE-2014-7849.