PT-2020-7592 · Red Hat · Jboss Eap 6

Published 2020-01-02 · Updated 2020-01-14 · CVE-2014-0169

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss EAP 6 (affected versions not specified)

Description The issue concerns a security domain in JBoss EAP 6 that uses a shared cache among all applications within the domain. This could potentially allow an authenticated user in one application to access protected resources in another application without proper authorization. The functionality, although intended, was not clearly documented, which may mislead users into believing the cache is isolated to a single application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2014-0169

Affected Products

Jboss Eap 6

References · 3

• https://access.redhat.com/security/cve/cve-2014-0169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0169 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0169 · Vendor Advisory