Authorization Bypass

2018-11-0708:01:08

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON

IronJacamar is vulnerable to an authorization bypass. The library does not use the credentials given in the getConnection function, allowing a malicious user to gain access to a datasource connection by attempting an invalid connection.

CPENameOperatorVersion
ironjacamar: deployers commonle1.1.0.Beta1
ironjacamar: jdbcle1.1.0.Beta1
slf4j-eap6eq1.6.1__19.redhat_1.ep6.el6
slf4j-eap6eq1.6.1__19.redhat_1.ep6.el5
ws-commons-xmlschemaeq2.0.2__1.redhat_1.1.ep6.el6
ws-commons-xmlschemaeq2.0.2__2.redhat_1.1.ep6.el5
ws-commons-xmlschemaeq1.4.5__2.4.ep5.el6
jboss-seam-inteq6.0.0__6.GA_redhat_1.ep6.el5
jboss-seam-inteq5.1.0__2.ep5.el6
jboss-seam-inteq6.0.0__5.GA_redhat_1.ep6.el6

Name	Operator	Version
ironjacamar: deployers common	le	1.1.0.Beta1
ironjacamar: jdbc	le	1.1.0.Beta1
slf4j-eap6	eq	1.6.1__19.redhat_1.ep6.el6
slf4j-eap6	eq	1.6.1__19.redhat_1.ep6.el5
ws-commons-xmlschema	eq	2.0.2__1.redhat_1.1.ep6.el6
ws-commons-xmlschema	eq	2.0.2__2.redhat_1.1.ep6.el5
ws-commons-xmlschema	eq	1.4.5__2.4.ep5.el6
jboss-seam-int	eq	6.0.0__6.GA_redhat_1.ep6.el5
jboss-seam-int	eq	5.1.0__2.ep5.el6
jboss-seam-int	eq	6.0.0__5.GA_redhat_1.ep6.el6