Permissions, Privileges, and Access Controls in JBoss Enterprise Application Platform - CVE-2014-7849

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU40893

Permissions, Privileges, and Access Controls in JBoss Enterprise Application Platform - CVE-2014-7849

Published: February 13, 2015 / Updated: August 9, 2020


Vulnerability identifier: #VU40893
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2014-7849
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Red Hat Inc.
Affected software:
JBoss Enterprise Application Platform

Detailed vulnerability description

The vulnerability allows a remote #AU# to manipulate data.

The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer role.


How to mitigate CVE-2014-7849

Install update from vendor's website.

Sources