CVE-2014-3472

Summary

CVE	CVE-2014-3472
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2014-08-19 18:55:00 UTC
Updated	2017-08-29 01:34:00 UTC
Description	The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

Risk And Classification

Problem Types: CWE-264

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Redhat	Jboss Enterprise Application Platform	6.3.0	All	All	All
Application	Redhat	Jboss Enterprise Application Platform	6.3.0	All	All	All

References

Reference	Source	Link	Tags
Bug 1103815 – CVE-2014-3472 JBoss AS Security: Invalid EJB caller role check implementation	CONFIRM	bugzilla.redhat.com
Red Hat Customer Portal	REDHAT	rhn.redhat.com	Vendor Advisory
IBM X-Force Exchange	XF	exchange.xforce.ibmcloud.com
Red Hat Customer Portal	REDHAT	rhn.redhat.com	Vendor Advisory
Red Hat Customer Portal	REDHAT	rhn.redhat.com	Vendor Advisory
Red Hat Customer Portal	REDHAT	rhn.redhat.com	Vendor Advisory
Malformed Request	BID	www.securityfocus.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

241029 Red Hat Update for JBoss Enterprise Application Platform 6.3.0 (RHSA-2014:1020)
241030 Red Hat Update for JBoss Enterprise Application Platform 6.3.0 (RHSA-2014:1019)