Public Date:
870868: CVE-2012-4549 JBoss AS: EJB authorization succeeds for any role when allowed roles list is empty

The MITRE CVE dictionary describes this issue as:

The processInvocation function in in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.

Find out more about CVE-2012-4549 from the MITRE CVE dictionary dictionary and NIST NVD.


This issue did not affect JBoss Enterprise Application Platform versions 4.x and 5.x.

CVSS v2 metrics

Base Score 5.8
Base Metrics AV:N/AC:M/Au:N/C:P/I:P/A:N
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat JBoss Enterprise Application Platform 6.0 RHSA-2012:1594 2012-12-18
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server RHSA-2012:1592 2012-12-18
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server RHSA-2012:1591 2012-12-18


This issue was discovered by Arun Neelicattu of the Red Hat Security Response Team.

Last Modified

CVE description copyright © 2017, The MITRE Corporation


Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.