CVE-2014-3464

published 2014-08-19

CVE-2014-3464: The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce…

Priority P4 24 medium 5.5 CVSS 2.0

AV N AC L Au S C P I P A N

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
redhat	jboss_enterprise_application_platform	—	—
redhat	jboss_enterprise_application_platform	—	—

CVSS provenance

nvd v2.0 5.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:N

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.