CVE-2014-7849
Management: Limited RBAC authorization bypass
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer role.
La implementación Role Based Access Control (RBAC) en JBoss Enterprise Application Platform (EAP) 6.2.0 hasta 6.3.2 no verifica correctamente las condiciones de la autorización, lo que permite a usuarios remotos autenticados añadir, modificar y desdefinir atributos de otra manera restringidos mediante el aprovechamiento del rol de mantenador (Maintainer).
It was discovered that the Role Based Access Control (RBAC) implementation did not sufficiently verify all authorization conditions that are required by the Maintainer role to perform certain administrative actions. An authenticated user with the Maintainer role could use this flaw to add, modify, or undefine a limited set of attributes and their values, which otherwise cannot be written to.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-10-03 CVE Reserved
- 2015-02-12 CVE Published
- 2024-08-06 CVE Updated
- 2024-09-25 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
- CWE-863: Incorrect Authorization
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://www.securitytracker.com/id/1031741 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/100890 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2015-0215.html | 2017-09-08 | |
| http://rhn.redhat.com/errata/RHSA-2015-0216.html | 2017-09-08 | |
| http://rhn.redhat.com/errata/RHSA-2015-0217.html | 2017-09-08 | |
| http://rhn.redhat.com/errata/RHSA-2015-0218.html | 2017-09-08 | |
| http://rhn.redhat.com/errata/RHSA-2015-0920.html | 2017-09-08 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1165170 | 2015-04-30 | |
| https://access.redhat.com/security/cve/CVE-2014-7849 | 2015-04-30 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.2.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.2.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.2.1 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.2.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.2.2 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.2.2" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.2.3 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.2.3" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.2.4 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.2.4" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.3.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.3.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.3.1 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.3.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.3.2 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.3.2" | - |
Affected
| ||||||