REDHAT-BUG-802622: Medium severity jboss vulnerability

Published Mar 13, 2012

Updated

When a JBoss server is configured to use JaccAuthorizationRealm, the WebPermissionMapping class creates permissions that are not checked and can permit access to users without checking their roles. If the ignoreBaseDecision property is set to true on JBossWebRealm, the web authorization process is handled exclusively by JBossAuthorizationEngine, without any input from JBoss Web. This allows any valid user to access an application, without needing to be assigned the role specified in the application's web.xml <security-constraint> tag.

Affected Software

1 affected component

Red Hat JBoss

Event History

Mar 13, 2012

Data Sourced

via Red Hat·05:41 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-802622?

The severity of REDHAT-BUG-802622 is considered high due to unchecked permissions that may allow unauthorized access.

How do I fix REDHAT-BUG-802622?

To fix REDHAT-BUG-802622, ensure the ignoreBaseDecision property is set to false in JBossWebRealm configuration.

What impact does REDHAT-BUG-802622 have on JBoss security?

REDHAT-BUG-802622 can compromise security by allowing users to access restricted resources without proper role checks.

Which versions of JBoss are affected by REDHAT-BUG-802622?

REDHAT-BUG-802622 affects various versions of Red Hat JBoss Middleware that utilize JaccAuthorizationRealm.

Is there a workaround for REDHAT-BUG-802622?

A temporary workaround for REDHAT-BUG-802622 is to manually verify user roles before granting permissions in your application logic.