Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

CVE-2014-3472

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

CVE-2014-3472: Undefined Security Weakness

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

PT-2014-5344

Name of the Vulnerable Software and Affected Versions JBoss Application Server versions 7 Red Hat JBoss Enterprise Application Platform version 6.3.0 Description The issue is related to the isCallerInRole function in SimpleSecurityManager, which does not properly check caller roles. This allows...

Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...