The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
InfoVulnerability
CVE-2014-3464: The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP)…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2014-3464
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 1.1%
Summary
CVE-2014-3464 affects the EJB invocation handler in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0. The handler does not properly enforce method level restrictions for outbound messages, letting remote authenticated users reach otherwise restricted JAX-WS handlers if they hold permissions on the EJB class. The NVD notes it stems from an incomplete fix for CVE-2013-2133.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.