Medium severity6.5NVD Advisory· Published Jan 5, 2013· Updated May 14, 2026
CVE-2012-4549
CVE-2012-4549
Description
A flaw was found in JBoss Enterprise Application Platform. The processInvocation function within the org.jboss.as.ejb3.security.AuthorizationInterceptor component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.
Affected products
11cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*range: <=6.0.0
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.2:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- rhn.redhat.com/errata/RHSA-2012-1591.htmlnvdVendor Advisory
- rhn.redhat.com/errata/RHSA-2012-1592.htmlnvdVendor Advisory
- rhn.redhat.com/errata/RHSA-2012-1594.htmlnvdVendor Advisory
- secunia.com/advisories/51607nvdVendor Advisory
- access.redhat.com/errata/RHSA-2012:1591nvd
- access.redhat.com/errata/RHSA-2012:1592nvd
- access.redhat.com/errata/RHSA-2012:1594nvd
- access.redhat.com/security/cve/CVE-2012-4549nvd
News mentions
0No linked articles in our index yet.