CoreCVE
Back

MEDIUM

WS: EJB3 role restrictions are not applied to jaxws handlers

Published Dec 6, 2013

Description

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.

Affected products

Remediation

Red Hat statement

Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/

Metrics

Weaknesses (2)

CWE-264

CWE-862

Missing Authorization

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Dec 6, 2013
Updated Aug 6, 2024
Reserved Feb 19, 2013
Link CVE-2013-2133
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2013-2133
Red Hat
Severity Low
Public date Dec 4, 2013
Links CVE-2013-2133 - Bugzilla