CVE-2012-4549
The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS probability
- 0.26%
- CWE
- CWE-266
- Published
- 2013-01-05
- Last modified
- 2026-05-14
Affected products
- n/a n/a
- Red Hat Red Hat JBoss Enterprise Application Platform 6 for RHEL 5
- Red Hat Red Hat JBoss Enterprise Application Platform 6 for RHEL 5
- Red Hat Red Hat JBoss Enterprise Application Platform 6 for RHEL 5
- Red Hat Red Hat JBoss Enterprise Application Platform 6 for RHEL 5
- Red Hat Red Hat JBoss Enterprise Application Platform 6 for RHEL 5
- Red Hat Red Hat JBoss Enterprise Application Platform 6 for RHEL 5
- Red Hat Red Hat JBoss Enterprise Application Platform 6 for RHEL 5
Weakness type
Related vulnerabilities
- CVE-2026-78477 — The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This mak
- CVE-2026-84814 — WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability
- CVE-2026-81294 — WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability
- CVE-2026-78330 — Apache Syncope: Privilege escalation for admin user via JWT authentication
- CVE-2026-78267 — WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability
- CVE-2026-73390 — WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability
- CVE-2026-73347 — WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability
- CVE-2026-66682 — WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability