CVE-2014-7853

The CVE-2014-7853 issue affects Red Hat JBoss Enterprise Application Platform 6.x (WildFly) where the JacORB subsystem did not correctly classify socket-binding-ref sensitivity for the security-domain attribute, enabling remote authenticated users to disclose sensitive information. Affects EAP/Wi...

CVE-2014-8122

CVE-2014-8122 describes a race condition in JBoss Weld (pre-2.2.8 and pre-3.0.0 Alpha3) where conversation state stored in a thread-local variable was not sanitized at end of a conversation. This could allow a remote attacker to disclose information from a previous conversation to the current one...

CVE-2014-7827

The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform EAP before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access...

CVE-2014-8122

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state...

CVE-2014-7827

CVE-2014-7827 affects Red Hat JBoss EAP 6.x (JBoss Security) where the org.jboss.security.plugins.mapping.JBossMappingManager uses the default security domain when a domain is undefined. This allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the...

CVE-2014-7827

The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform EAP before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access...

CVE-2014-8122

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state...

PT-2015-3933

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform EAP versions prior to 6.3.3 Description The issue affects the JBoss Application Server WildFly JacORB subsystem, where it fails to properly assign socket-binding-ref sensitivity classification to t...

PT-2015-4009

Name of the Vulnerable Software and Affected Versions JBoss Weld versions prior to 2.2.8 JBoss Weld versions 3.x prior to 3.0.0 Alpha3 Description A race condition exists, allowing remote attackers to obtain information from a previous conversation via vectors related to a stale thread state...

PT-2015-3932

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform EAP versions 6.2.0 through 6.3.2 Description The Role Based Access Control RBAC implementation does not properly verify authorization conditions. This allows remote authenticated users to add, modify, and...

RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.3.3 update (Moderate) (RHSA-2015:0217)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0217 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that t...

CVE-2014-7827: Undefined Security Weakness

The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform EAP before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access...

CVE-2014-7853: Exposure of Sensitive Information to an Unauthorized Actor

The JBoss Application Server WildFly JacORB subsystem in Red Hat JBoss Enterprise Application Platform EAP before 6.3.3 does not properly assign socket-binding-ref sensitivity classification to the security-domain attribute, which allows remote authenticated users to obtain sensitive information ...

CVE-2014-7849: Undefined Security Weakness

The Role Based Access Control RBAC implementation in JBoss Enterprise Application Platform EAP 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer...

CVE-2014-8122: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state...

PT-2015-3931

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform EAP versions prior to 6.3.3 Description The issue concerns the org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security. It allows remote authenticated users to bypas...

RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.3.3 update (Moderate) (RHSA-2015:0216)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0216 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that t...

Weld: Limited information disclosure via stale thread state

It was discovered that under specific conditions the conversation state information stored in a thread-local variable in JBoss Weld was not sanitized correctly when the conversation ended. This could lead to a race condition that could potentially expose sensitive information from a previous...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.3 and fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Commo...

Security: Wrong security context loaded when using SAML2 STS Login Module

It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...