Description
A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers (JACC) permissions from being applied, allowing remote attackers to gain unauthorized access to EJBs.
Published: 2013-01-05
Score: 5.3 Medium
EPSS: 2.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2012-4478 JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, when using role-based authorization for Enterprise Java Beans (EJB) access, does not call the intended authorization modules, which prevents JACC permissions from being applied and allows remote attackers to obtain access to the EJB.
History

Thu, 14 May 2026 22:45:00 +0000

Type Values Removed Values Added
Description JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, when using role-based authorization for Enterprise Java Beans (EJB) access, does not call the intended authorization modules, which prevents JACC permissions from being applied and allows remote attackers to obtain access to the EJB. A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers (JACC) permissions from being applied, allowing remote attackers to gain unauthorized access to EJBs.
Title JACC: Security constraints configured for EJBs are incorrectly interpreted and not applied Jboss enterprise application platform: jboss eap: jbeap: jboss enterprise application platform: unauthorized ejb access via authorization module bypass
First Time appeared Redhat jbosseapxp
Weaknesses CWE-280
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat jbosseapxp
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Redhat Jboss Enterprise Application Platform Jbosseapxp
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-05-14T22:16:38.618Z

Reserved: 2012-08-21T00:00:00.000Z

Link: CVE-2012-4550

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2013-01-05T00:55:02.993

Modified: 2026-06-16T23:45:20.610

Link: CVE-2012-4550

cve-icon Redhat

Severity : Important

Publid Date: 2012-04-19T00:00:00Z

Links: CVE-2012-4550 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-264
  • CWE-280

    Improper Handling of Insufficient Permissions or Privileges