NVD

Id
31660  
Name
CVE-2014-3472  
Description
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.  
Reject
 
CVSS Version
2  
CVSS Score
4.9  
Severity
Medium  
CVSS Base Score
4.9  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-08-19  
Modified Date
2017-01-06  
Seq
2014-3472  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
165923 31660 CVE-2014-3472 RHSA-2014:1019  View
165924 31660 CVE-2014-3472 RHSA-2014:1020  View
165925 31660 CVE-2014-3472 RHSA-2014:1021  View
165926 31660 CVE-2014-3472 RHSA-2015:0720  View
165927 31660 CVE-2014-3472 69094  View
165928 31660 CVE-2014-3472 jboss-cve20143472-sec-bypass(95170)  View
165929 31660 CVE-2014-3472 https://bugzilla.redhat.com/show_bug.cgi?id=1103815  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14979 JVNDB-2014-003854 Red Hat JBoss Enterprise Application Platform で使用される JBoss Application Server の SimpleSecurityManager の isCallerInRole 関数におけるアクセス制限を回避される脆弱性 Red Hat JBoss Enterprise Application Platform (JBEAP) で使用される JBoss Application Server (AS) 7 の SimpleSecurityManager の isCallerInRole 関数は、caller のロールを適切にチェックしないため、アクセス制限を回避される脆弱性が存在します。 CVE-2014-3472 70760 CVE-2014-3472 31660 4.9 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003854.html 2014-08-06 2015-05-11 View