A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.
History

Thu, 14 May 2026 22:45:00 +0000

Type Values Removed Values Added
Description The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods. A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.
Title AS: EJB authorization succeeds for any role when allowed roles list is empty Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization
First Time appeared Redhat jbosseapxp
Weaknesses CWE-266
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat jbosseapxp
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2013-01-05T00:00:00.000Z

Updated: 2026-05-14T22:16:33.378Z

Reserved: 2012-08-21T00:00:00.000Z

Link: CVE-2012-4549

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2013-01-05T00:55:02.947

Modified: 2026-05-14T23:16:32.133

Link: CVE-2012-4549

cve-icon Redhat

Severity : Moderate

Publid Date: 2012-12-18T00:00:00Z

Links: CVE-2012-4549 - Bugzilla