Back

MEDIUM

Management: Limited RBAC authorization bypass

Published Feb 13, 2015

Description

The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer role.

Affected products

Remediation

Red Hat statement

This issue did not affect the versions of Red Hat JBoss Enterprise Application Platform before 6.2.0 as they did not include support for role-based access control (RBAC).

Metrics

References (11)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Feb 13, 2015
Updated Aug 6, 2024
Reserved Oct 3, 2014
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Moderate
Public date Feb 11, 2015