CVE-2014-3464
WS: Incomplete fix for CVE-2013-2133
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.
La implementación del manejador de la invocación EJB en Red Hat JBossWS, utilizada en JBoss Enterprise Application Platform (EAP) 6.2.0 y 6.3.0, no aplica debidamente las restricciones de nivel de método para mensajes salientes, lo que permite a usuarios remotos autenticados acceder a manejadores JAX-WS de otra manera restringidos mediante el aprovechamiento de permisos para la clase EJB. NOTA: esta vulnerabilidad existe debido a una solución incompleta para el CVE-2013-2133.
It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-05-14 CVE Reserved
- 2014-08-19 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (6)
URL | Tag | Source |
---|---|---|
https://exchange.xforce.ibmcloud.com/vulnerabilities/95409 | Vdb Entry |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://rhn.redhat.com/errata/RHSA-2014-1019.html | 2017-08-29 | |
http://rhn.redhat.com/errata/RHSA-2014-1020.html | 2017-08-29 | |
http://rhn.redhat.com/errata/RHSA-2014-1021.html | 2017-08-29 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1102317 | 2014-08-06 | |
https://access.redhat.com/security/cve/CVE-2014-3464 | 2014-08-06 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.2.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.2.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.3.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.3.0" | - |
Affected
|