Vulnerability Details : CVE-2014-3472
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.
Exploit prediction scoring system (EPSS) score for CVE-2014-3472
Probability of exploitation activity in the next 30 days: 0.21%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 58 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-3472
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.9
|
MEDIUM | AV:N/AC:M/Au:S/C:P/I:P/A:N |
6.8
|
4.9
|
NIST |
CWE ids for CVE-2014-3472
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3472
-
http://rhn.redhat.com/errata/RHSA-2014-1019.html
RHSA-2014:1019 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
http://www.securityfocus.com/bid/69094
JBoss AS Security CVE-2014-3472 Security Bypass Vulnerability
-
http://rhn.redhat.com/errata/RHSA-2014-1020.html
RHSA-2014:1020 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1103815
1103815 – (CVE-2014-3472) CVE-2014-3472 JBoss AS Security: Invalid EJB caller role check implementation
-
http://rhn.redhat.com/errata/RHSA-2015-0720.html
RHSA-2015:0720 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2014-1021.html
Red Hat Customer PortalVendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/95170
Red Hat JBoss AS SimpleSecurityManager security bypass CVE-2014-3472 Vulnerability Report
Products affected by CVE-2014-3472
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.3.0:*:*:*:*:*:*:*