CVE-2014-3464

Severity: medium (CVSS 5.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-08-19 · updated 2026-06-17
Weakness: CWE-264

Description

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.

Affected products

Red Hat JBoss EAP: 6.2.0, 6.3.0

References

http://rhn.redhat.com/errata/RHSA-2014-1019.html
http://rhn.redhat.com/errata/RHSA-2014-1020.html
http://rhn.redhat.com/errata/RHSA-2014-1021.html
https://bugzilla.redhat.com/show_bug.cgi?id=1102317
https://exchange.xforce.ibmcloud.com/vulnerabilities/95409
http://rhn.redhat.com/errata/RHSA-2014-1019.html
http://rhn.redhat.com/errata/RHSA-2014-1020.html
http://rhn.redhat.com/errata/RHSA-2014-1021.html
https://bugzilla.redhat.com/show_bug.cgi?id=1102317
https://exchange.xforce.ibmcloud.com/vulnerabilities/95409

Get alerted when CVE-2014-3464 or the next vulnerability affects your stack