NetSight
IP …
medium5.5

CVE-2013-2133

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce th…

Impact

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.

Affected products

VendorProductAffected versions
RedhatJboss Enterprise Application Platform
through 6.1.0
Versions 4.2.0, 4.3.0, 5.0.0, 5.0.1, 5.1.0
RedhatEnterprise Linux
Versions 5, 6.0

Weakness classification

CWE-264

References