PT-2014-5342 · Red Hat · Red Hat Jbossws

Publicado 2014-08-19 · Atualizado 2017-08-29 · CVE-2014-3464

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBossWS versions 6.2.0 through 6.3.0

Description The EJB invocation handler implementation in Red Hat JBossWS does not properly enforce method level restrictions for outbound messages. This allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.

Recommendations For versions 6.2.0 through 6.3.0, consider restricting access to the EJB class to minimize the risk of exploitation until a proper fix is applied.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-3464

RHSA-2014:1019

RHSA-2014:1020

Produtos afetados

Red Hat Jbossws

Referências · 7

• http://rhn.redhat.com/errata/RHSA-2014-1020.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-1021.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95409 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3464 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3464 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2014-1019.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1102317 · Nota