Authorization

2013-10-2821:55:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

Low

3.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:H/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.4%

JSON

Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications’ authorization decisions via a crafted application.

CPENameOperatorVersion
jboss_enterprise_application_platformeq5.1.2
jboss_enterprise_application_platformeq4.3.0
jboss_enterprise_application_platformeq6.0.0
jboss_enterprise_application_platformeq5.2.2
jboss_enterprise_application_platformeq5.1.1
jboss_enterprise_application_platformeq5.0.1
jboss_enterprise_application_platformeq5.1.0
jboss_enterprise_application_platformeq5.2.0
jboss_enterprise_application_platformeq5.2.1
jboss_enterprise_application_platformle6.0.1

Name	Operator	Version
jboss_enterprise_application_platform	eq	5.1.2
jboss_enterprise_application_platform	eq	4.3.0
jboss_enterprise_application_platform	eq	6.0.0
jboss_enterprise_application_platform	eq	5.2.2
jboss_enterprise_application_platform	eq	5.1.1
jboss_enterprise_application_platform	eq	5.0.1
jboss_enterprise_application_platform	eq	5.1.0
jboss_enterprise_application_platform	eq	5.2.0
jboss_enterprise_application_platform	eq	5.2.1
jboss_enterprise_application_platform	le	6.0.1