Description

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.

Remediation

References

CVE-2014-3464

Related Vulnerabilities

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2009-4018)

WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-5610)

Oracle Application Server Other Vulnerability (CVE-2001-1372)

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Scripting (2.5.7)

OpenSSL Improper Input Validation Vulnerability (CVE-2015-1787)

Severity

Medium

Classification

CVE-2014-3464 CWE-264

Tags

Missing Update Known Vulnerabilities