Main Vulnerability Database Vulnerabilities #VU40893

Permissions, Privileges, and Access Controls in JBoss Enterprise Application Platform - CVE-2014-7849

Published: February 13, 2015 / Updated: August 9, 2020

Vulnerability identifier: #VU40893

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-7849

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote #AU# to manipulate data.

The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer role.

Affected software

JBoss Enterprise Application Platform

How to mitigate CVE-2014-7849

Install update from vendor's website.

External References

Related Security Bulletins