CVE-2012-4550

JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, when using role-based authorization for Enterprise Java Beans (EJB) access, does not call the intended authorization modules, which prevents JACC permissions from being applied and allows remote attackers to obtain access to the EJB.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2012-1591.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1592.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1594.html	Vendor Advisory
http://secunia.com/advisories/51607	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2013-01-05 00:55

Updated : 2024-02-28 12:00

NVD link : CVE-2012-4550

Mitre link : CVE-2012-4550

CVE.ORG link : CVE-2012-4550

JSON object : View

Products Affected

redhat

jboss_enterprise_application_platform

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2012-4550", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-01-05T00:55:02.993", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2012-1591.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2012-1592.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2012-1594.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/51607", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, when using role-based authorization for Enterprise Java Beans (EJB) access, does not call the intended authorization modules, which prevents JACC permissions from being applied and allows remote attackers to obtain access to the EJB."}, {"lang": "es", "value": "JBoss Enterprise Application Platform (tamb\u00eden conocido como JBoss EAP o JBEAP) anteriores a \r\nv6.0.1, cuando se usa una autorizaci\u00f3n basada en roles para acceder a Enterprise Java Beans (EJB), no llama a los m\u00f3dulos de autorizaci\u00f3n de forma adecuada, lo que evita que se puedan usar los permisos JACC de ser aplicados y permiten a atacantes remotos obtener acceso a EJB."}], "lastModified": "2013-05-07T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B142ACCC-F7A9-4A3B-BE60-0D6691D5058D"}], "operator": "OR"}]}], "evaluatorImpact": "Per https://bugzilla.redhat.com/show_bug.cgi?id=870871#c7\r\n\"This issue did not affect JBoss Enterprise Application Platform versions 4.x and 5.x.\"", "sourceIdentifier": "secalert@redhat.com"}