What’s Vulnerable › Vulnerabilities

CVE-2012-4549: Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization

• Severity: medium (CVSS 5.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-01-05 · updated 2026-06-16
• Weakness: CWE-266

Description

A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.

Affected products

• Red Hat JBoss EAP: through 6.0.0; 4.2.0, 4.3.0, 5.0.0, 5.0.1, 5.1.0, 5.1.1 (+4)

References

• http://rhn.redhat.com/errata/RHSA-2012-1591.html
• http://rhn.redhat.com/errata/RHSA-2012-1592.html
• http://rhn.redhat.com/errata/RHSA-2012-1594.html
• http://secunia.com/advisories/51607
• https://access.redhat.com/errata/RHSA-2012:1591
• https://access.redhat.com/errata/RHSA-2012:1592
• https://access.redhat.com/errata/RHSA-2012:1594
• https://access.redhat.com/security/cve/CVE-2012-4549
• http://rhn.redhat.com/errata/RHSA-2012-1591.html
• http://rhn.redhat.com/errata/RHSA-2012-1592.html
• http://rhn.redhat.com/errata/RHSA-2012-1594.html
• http://secunia.com/advisories/51607

Get alerted when CVE-2012-4549 or the next vulnerability affects your stack