Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization

Summary

A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.

Timeline

1. Jan 5, 2013, 12:00 AM UTCCVE published
2. May 14, 2026, 10:16 PM UTCRecord last updated

Affected versions

• Red Hat Red Hat JBoss Enterprise Application Platform 6.0

  Version range not reported

• antlr-eap6

  Version range not reported

• apache-commons-beanutils

  Version range not reported

• apache-commons-cli

  Version range not reported

• apache-commons-codec-eap6

  Version range not reported

• apache-commons-collections

  Version range not reported

• apache-commons-collections-eap6

  Version range not reported

• apache-commons-configuration

  Version range not reported

• apache-commons-daemon-jsvc-eap6

  Version range not reported

• apache-commons-io-eap6

  Version range not reported

• apache-commons-lang

  Version range not reported

• apache-commons-lang-eap6

  Version range not reported

• apache-commons-pool-eap6

  Version range not reported

• apache-cxf

  Version range not reported

• apache-cxf-xjc-utils

  Version range not reported

• apache-mime4j

  Version range not reported

• atinject

  Version range not reported

• cal10n

  Version range not reported

• codehaus-jackson

  Version range not reported

• dom4j

  Version range not reported

• glassfish-jaf

  Version range not reported

• glassfish-javamail

  Version range not reported

• glassfish-jaxb

  Version range not reported

• glassfish-jsf

  Version range not reported

• glassfish-jsf12

  Version range not reported

• gnu-getopt

  Version range not reported

• guava-libraries

  Version range not reported

• h2database

  Version range not reported

• hibernate3-commons-annotations

  Version range not reported

• hibernate4

  Version range not reported

• hibernate4-validator

  Version range not reported

• hibernate-beanvalidation-api

  Version range not reported

• hibernate-jpa-2.0-api

  Version range not reported

• hornetq

  Version range not reported

• hornetq-native

  Version range not reported

• httpcomponents

  Version range not reported

• httpd

  Version range not reported

• httpserver

  Version range not reported

• infinispan

  Version range not reported

• ironjacamar

  Version range not reported

• jacorb-jboss

  Version range not reported

• jandex

  Version range not reported

• javassist-eap6

  Version range not reported

• jaxbintros

  Version range not reported

• jaxen

  Version range not reported

• jaxws-jboss-httpserver-httpspi

  Version range not reported

• jbosgi-deployment

  Version range not reported

• jbosgi-framework-core

  Version range not reported

• jbosgi-metadata

  Version range not reported

• jbosgi-repository

  Version range not reported

• jbosgi-resolver

  Version range not reported

• jbosgi-spi

  Version range not reported

• jbosgi-vfs

  Version range not reported

• jboss-annotations-api_1.1_spec

  Version range not reported

• jboss-as-appclient

  Version range not reported

• jbossas-appclient

  Version range not reported

• jbossas-bundles

  Version range not reported

• jboss-as-cli

  Version range not reported

• jboss-as-client-all

  Version range not reported

• jboss-as-clustering

  Version range not reported

• jboss-as-cmp

  Version range not reported

• jboss-as-configadmin

  Version range not reported

• jboss-as-connector

  Version range not reported

• jboss-as-console

  Version range not reported

• jboss-as-controller

  Version range not reported

• jboss-as-controller-client

  Version range not reported

• jbossas-core

  Version range not reported

• jboss-as-deployment-repository

  Version range not reported

• jboss-as-deployment-scanner

  Version range not reported

• jbossas-domain

  Version range not reported

• jboss-as-domain-http

  Version range not reported

• jboss-as-domain-management

  Version range not reported

• jboss-as-ee

  Version range not reported

• jboss-as-ee-deployment

  Version range not reported

• jboss-as-ejb3

  Version range not reported

• jboss-as-embedded

  Version range not reported

• jboss-as-host-controller

  Version range not reported

• jboss-as-jacorb

  Version range not reported

• jbossas-javadocs

  Version range not reported

• jboss-as-jaxr

  Version range not reported

• jboss-as-jaxrs

  Version range not reported

• jboss-as-jdr

  Version range not reported

• jboss-as-jmx

  Version range not reported

• jboss-as-jpa

  Version range not reported

• jboss-as-jsf

  Version range not reported

• jboss-as-jsr77

  Version range not reported

• jboss-as-logging

  Version range not reported

• jboss-as-mail

  Version range not reported

• jboss-as-management-client-content

  Version range not reported

• jboss-as-messaging

  Version range not reported

• jboss-as-modcluster

  Version range not reported

• jbossas-modules-eap

  Version range not reported

• jboss-as-naming

  Version range not reported

• jboss-as-network

  Version range not reported

• jboss-as-osgi-configadmin

  Version range not reported

• jboss-as-osgi-service

  Version range not reported

• jboss-as-platform-mbean

  Version range not reported

• jboss-as-pojo

  Version range not reported

• jboss-as-process-controller

  Version range not reported

• jbossas-product-eap

  Version range not reported

• jboss-as-protocol

  Version range not reported

• jboss-as-remoting

  Version range not reported

• jboss-as-sar

  Version range not reported

• jboss-as-security

  Version range not reported

• jboss-as-server

  Version range not reported

• jbossas-standalone

  Version range not reported

• jboss-as-threads

  Version range not reported

• jboss-as-transactions

  Version range not reported

• jboss-as-web

  Version range not reported

• jboss-as-webservices

  Version range not reported

• jbossas-welcome-content-eap

  Version range not reported

• jboss-as-weld

  Version range not reported

• jboss-as-xts

  Version range not reported

• jboss-classfilewriter

  Version range not reported

• jboss-common-beans

  Version range not reported

• jboss-common-core

  Version range not reported

• jboss-connector-api_1.6_spec

  Version range not reported

• jboss-dmr

  Version range not reported

• jboss-ejb3-ext-api

  Version range not reported

• jboss-ejb-api_3.1_spec

  Version range not reported

• jboss-ejb-client

  Version range not reported

• jboss-el-api_2.2_spec

  Version range not reported

• jboss-iiop-client

  Version range not reported

• jboss-interceptors-api_1.1_spec

  Version range not reported

• jboss-invocation

  Version range not reported

• jboss-j2eemgmt-api_1.1_spec

  Version range not reported

• jboss-jacc-api_1.4_spec

  Version range not reported

• jboss-jad-api_1.2_spec

  Version range not reported

• jboss-jaspi-api_1.0_spec

  Version range not reported

• jboss-jaxb-api_2.2_spec

  Version range not reported

• jboss-jaxr-api_1.0_spec

  Version range not reported

• jboss-jaxrpc-api_1.1_spec

  Version range not reported

• jboss-jaxrs-api_1.1_spec

  Version range not reported

• jboss-jaxws-api_2.2_spec

  Version range not reported

• jboss-jms-api_1.1_spec

  Version range not reported

• jboss-jsf-api_2.1_spec

  Version range not reported

• jboss-jsp-api_2.2_spec

  Version range not reported

• jboss-jstl-api_1.2_spec

  Version range not reported

• jboss-logging

  Version range not reported

• jboss-logmanager

  Version range not reported

• jboss-marshalling

  Version range not reported

• jboss-metadata

  Version range not reported

• jboss-modules

  Version range not reported

• jboss-msc

  Version range not reported

• jboss-osgi-logging

  Version range not reported

• jboss-remote-naming

  Version range not reported

• jboss-remoting3

  Version range not reported

• jboss-remoting3-jmx

  Version range not reported

• jboss-rmi-api_1.0_spec

  Version range not reported

• jboss-saaj-api_1.3_spec

  Version range not reported

• jboss-sasl

  Version range not reported

• jboss-seam-int

  Version range not reported

• jboss-security-negotiation

  Version range not reported

• jboss-security-xacml

  Version range not reported

• jboss-servlet-api_2.5_spec

  Version range not reported

• jboss-servlet-api_3.0_spec

  Version range not reported

• jboss-specs-parent

  Version range not reported

• jboss-stdio

  Version range not reported

• jboss-threads

  Version range not reported

• jboss-transaction-api_1.1_spec

  Version range not reported

• jboss-transaction-spi

  Version range not reported

• jbossts

  Version range not reported

• jboss-vfs2

  Version range not reported

• jbossweb

  Version range not reported

• jboss-weld-1.1-api

  Version range not reported

• jbossws-api

  Version range not reported

• jbossws-common

  Version range not reported

• jbossws-common-tools

  Version range not reported

• jbossws-cxf

  Version range not reported

• jbossws-native

  Version range not reported

• jbossws-spi

  Version range not reported

• jbossxb2

  Version range not reported

• jboss-xnio-base

  Version range not reported

• jcip-annotations

  Version range not reported

• jdom-eap6

  Version range not reported

• jettison

  Version range not reported

• jgroups

  Version range not reported

• jline-eap6

  Version range not reported

• joda-time

  Version range not reported

• jtype

  Version range not reported

• juddi

  Version range not reported

• jul-to-slf4j-stub

  Version range not reported

• jython-eap6

  Version range not reported

• log4j-eap6

  Version range not reported

• log4j-jboss-logmanager

  Version range not reported

• mod_cluster

  Version range not reported

• mod_cluster-native

  Version range not reported

• mod_jk

  Version range not reported

• netty

  Version range not reported

• objectweb-asm-eap6

  Version range not reported

• org.apache.felix.configadmin

  Version range not reported

• org.apache.felix.log

  Version range not reported

• org.osgi

  Version range not reported

• picketbox

  Version range not reported

• picketbox-commons

  Version range not reported

• picketlink-federation

  Version range not reported

• relaxngDatatype

  Version range not reported

• resteasy

  Version range not reported

• rngom

  Version range not reported

• scannotation

  Version range not reported

• shrinkwrap

  Version range not reported

• slf4j-eap6

  Version range not reported

• slf4j-jboss-logmanager

  Version range not reported

• snakeyaml

  Version range not reported

• staxmapper

  Version range not reported

• stilts

  Version range not reported

• sun-codemodel

  Version range not reported

• sun-istack-commons

  Version range not reported

• sun-saaj-1.3-impl

  Version range not reported

• sun-txw2

  Version range not reported

• sun-ws-metadata-2.0-api

  Version range not reported

• sun-xsom

  Version range not reported

• tomcat-native

  Version range not reported

• velocity-eap6

  Version range not reported

• weld-cdi-1.0-api

  Version range not reported

• weld-core

  Version range not reported

• woodstox-core

  Version range not reported

• ws-commons-neethi

  Version range not reported

• ws-commons-XmlSchema

  Version range not reported

• wsdl4j-eap6

  Version range not reported

• wss4j

  Version range not reported

• ws-scout

  Version range not reported

• xalan-j2-eap6

  Version range not reported

• xerces-j2-eap6

  Version range not reported

• xml-commons-resolver-eap6

  Version range not reported

• xml-security

  Version range not reported

• xom

  Version range not reported

• antlr-eap6

  Version range not reported

• apache-commons-beanutils

  Version range not reported

• apache-commons-cli

  Version range not reported

• apache-commons-codec-eap6

  Version range not reported

• apache-commons-collections-eap6

  Version range not reported

• apache-commons-configuration

  Version range not reported

• apache-commons-daemon-jsvc-eap6

  Version range not reported

• apache-commons-io-eap6

  Version range not reported

• apache-commons-lang-eap6

  Version range not reported

• apache-commons-pool-eap6

  Version range not reported

• apache-cxf

  Version range not reported

• apache-cxf-xjc-utils

  Version range not reported

• apache-mime4j

  Version range not reported

• atinject

  Version range not reported

• cal10n

  Version range not reported

• codehaus-jackson

  Version range not reported

• dom4j

  Version range not reported

• glassfish-jaf

  Version range not reported

• glassfish-javamail

  Version range not reported

• glassfish-jaxb

  Version range not reported

• glassfish-jsf

  Version range not reported

• glassfish-jsf12

  Version range not reported

• gnu-getopt

  Version range not reported

• guava-libraries

  Version range not reported

• h2database

  Version range not reported

• hibernate3-commons-annotations

  Version range not reported

• hibernate4

  Version range not reported

• hibernate4-validator

  Version range not reported

• hibernate-beanvalidation-api

  Version range not reported

• hibernate-jpa-2.0-api

  Version range not reported

• hornetq

  Version range not reported

• hornetq-native

  Version range not reported

• httpcomponents

  Version range not reported

• httpd

  Version range not reported

• httpserver

  Version range not reported

• infinispan

  Version range not reported

• ironjacamar

  Version range not reported

• jacorb-jboss

  Version range not reported

• jandex

  Version range not reported

• javassist-eap6

  Version range not reported

• jaxbintros

  Version range not reported

• jaxen

  Version range not reported

• jaxws-jboss-httpserver-httpspi

  Version range not reported

• jbosgi-deployment

  Version range not reported

• jbosgi-framework-core

  Version range not reported

• jbosgi-metadata

  Version range not reported

• jbosgi-repository

  Version range not reported

• jbosgi-resolver

  Version range not reported

• jbosgi-spi

  Version range not reported

• jbosgi-vfs

  Version range not reported

• jboss-annotations-api_1.1_spec

  Version range not reported

• jboss-as-appclient

  Version range not reported

• jbossas-appclient

  Version range not reported

• jbossas-bundles

  Version range not reported

• jboss-as-cli

  Version range not reported

• jboss-as-client-all

  Version range not reported

• jboss-as-clustering

  Version range not reported

• jboss-as-cmp

  Version range not reported

• jboss-as-configadmin

  Version range not reported

• jboss-as-connector

  Version range not reported

• jboss-as-console

  Version range not reported

• jboss-as-controller

  Version range not reported

• jboss-as-controller-client

  Version range not reported

• jbossas-core

  Version range not reported

• jboss-as-deployment-repository

  Version range not reported

• jboss-as-deployment-scanner

  Version range not reported

• jbossas-domain

  Version range not reported

• jboss-as-domain-http

  Version range not reported

• jboss-as-domain-management

  Version range not reported

• jboss-as-ee

  Version range not reported

• jboss-as-ee-deployment

  Version range not reported

• jboss-as-ejb3

  Version range not reported

• jboss-as-embedded

  Version range not reported

• jboss-as-host-controller

  Version range not reported

• jboss-as-jacorb

  Version range not reported

• jbossas-javadocs

  Version range not reported

• jboss-as-jaxr

  Version range not reported

• jboss-as-jaxrs

  Version range not reported

• jboss-as-jdr

  Version range not reported

• jboss-as-jmx

  Version range not reported

• jboss-as-jpa

  Version range not reported

• jboss-as-jsf

  Version range not reported

• jboss-as-jsr77

  Version range not reported

• jboss-as-logging

  Version range not reported

• jboss-as-mail

  Version range not reported

• jboss-as-management-client-content

  Version range not reported

• jboss-as-messaging

  Version range not reported

• jboss-as-modcluster

  Version range not reported

• jbossas-modules-eap

  Version range not reported

• jboss-as-naming

  Version range not reported

• jboss-as-network

  Version range not reported

• jboss-as-osgi-configadmin

  Version range not reported

• jboss-as-osgi-service

  Version range not reported

• jboss-as-platform-mbean

  Version range not reported

• jboss-as-pojo

  Version range not reported

• jboss-as-process-controller

  Version range not reported

• jbossas-product-eap

  Version range not reported

• jboss-as-protocol

  Version range not reported

• jboss-as-remoting

  Version range not reported

• jboss-as-sar

  Version range not reported

• jboss-as-security

  Version range not reported

• jboss-as-server

  Version range not reported

• jbossas-standalone

  Version range not reported

• jboss-as-threads

  Version range not reported

• jboss-as-transactions

  Version range not reported

• jboss-as-web

  Version range not reported

• jboss-as-webservices

  Version range not reported

• jbossas-welcome-content-eap

  Version range not reported

• jboss-as-weld

  Version range not reported

• jboss-as-xts

  Version range not reported

• jboss-classfilewriter

  Version range not reported

• jboss-common-beans

  Version range not reported

• jboss-common-core

  Version range not reported

• jboss-connector-api_1.6_spec

  Version range not reported

• jboss-dmr

  Version range not reported

• jboss-ejb3-ext-api

  Version range not reported

• jboss-ejb-api_3.1_spec

  Version range not reported

• jboss-ejb-client

  Version range not reported

• jboss-el-api_2.2_spec

  Version range not reported

• jboss-iiop-client

  Version range not reported

• jboss-interceptors-api_1.1_spec

  Version range not reported

• jboss-invocation

  Version range not reported

• jboss-j2eemgmt-api_1.1_spec

  Version range not reported

• jboss-jacc-api_1.4_spec

  Version range not reported

• jboss-jad-api_1.2_spec

  Version range not reported

• jboss-jaspi-api_1.0_spec

  Version range not reported

• jboss-jaxb-api_2.2_spec

  Version range not reported

• jboss-jaxr-api_1.0_spec

  Version range not reported

• jboss-jaxrpc-api_1.1_spec

  Version range not reported

• jboss-jaxrs-api_1.1_spec

  Version range not reported

• jboss-jaxws-api_2.2_spec

  Version range not reported

• jboss-jms-api_1.1_spec

  Version range not reported

• jboss-jsf-api_2.1_spec

  Version range not reported

• jboss-jsp-api_2.2_spec

  Version range not reported

• jboss-jstl-api_1.2_spec

  Version range not reported

• jboss-logging

  Version range not reported

• jboss-logmanager

  Version range not reported

• jboss-marshalling

  Version range not reported

• jboss-metadata

  Version range not reported

• jboss-modules

  Version range not reported

• jboss-msc

  Version range not reported

• jboss-osgi-logging

  Version range not reported

• jboss-remote-naming

  Version range not reported

• jboss-remoting3

  Version range not reported

• jboss-remoting3-jmx

  Version range not reported

• jboss-rmi-api_1.0_spec

  Version range not reported

• jboss-saaj-api_1.3_spec

  Version range not reported

• jboss-sasl

  Version range not reported

• jboss-seam-int

  Version range not reported

• jboss-security-negotiation

  Version range not reported

• jboss-security-xacml

  Version range not reported

• jboss-servlet-api_2.5_spec

  Version range not reported

• jboss-servlet-api_3.0_spec

  Version range not reported

• jboss-specs-parent

  Version range not reported

• jboss-stdio

  Version range not reported

• jboss-threads

  Version range not reported

• jboss-transaction-api_1.1_spec

  Version range not reported

• jboss-transaction-spi

  Version range not reported

• jbossts

  Version range not reported

• jboss-vfs2

  Version range not reported

• jbossweb

  Version range not reported

• jboss-weld-1.1-api

  Version range not reported

• jbossws-api

  Version range not reported

• jbossws-common

  Version range not reported

• jbossws-common-tools

  Version range not reported

• jbossws-cxf

  Version range not reported

• jbossws-native

  Version range not reported

• jbossws-spi

  Version range not reported

• jbossxb2

  Version range not reported

• jboss-xnio-base

  Version range not reported

• jcip-annotations

  Version range not reported

• jdom-eap6

  Version range not reported

• jettison

  Version range not reported

• jgroups

  Version range not reported

• jline-eap6

  Version range not reported

• joda-time

  Version range not reported

• jtype

  Version range not reported

• juddi

  Version range not reported

• jul-to-slf4j-stub

  Version range not reported

• jython-eap6

  Version range not reported

• log4j-eap6

  Version range not reported

• log4j-jboss-logmanager

  Version range not reported

• mod_cluster

  Version range not reported

• mod_cluster-native

  Version range not reported

• mod_jk

  Version range not reported

• netty

  Version range not reported

• objectweb-asm-eap6

  Version range not reported

• org.apache.felix.configadmin

  Version range not reported

• org.apache.felix.log

  Version range not reported

• org.osgi

  Version range not reported

• picketbox

  Version range not reported

• picketbox-commons

  Version range not reported

• picketlink-federation

  Version range not reported

• relaxngDatatype

  Version range not reported

• resteasy

  Version range not reported

• rngom

  Version range not reported

• scannotation

  Version range not reported

• shrinkwrap

  Version range not reported

• slf4j-eap6

  Version range not reported

• slf4j-jboss-logmanager

  Version range not reported

• snakeyaml

  Version range not reported

• staxmapper

  Version range not reported

• stilts

  Version range not reported

• sun-codemodel

  Version range not reported

• sun-istack-commons

  Version range not reported

• sun-saaj-1.3-impl

  Version range not reported

• sun-txw2

  Version range not reported

• sun-ws-metadata-2.0-api

  Version range not reported

• sun-xsom

  Version range not reported

• tomcat-native

  Version range not reported

• velocity-eap6

  Version range not reported

• weld-cdi-1.0-api

  Version range not reported

• weld-core

  Version range not reported

• woodstox-core

  Version range not reported

• ws-commons-neethi

  Version range not reported

• ws-commons-XmlSchema

  Version range not reported

• wsdl4j-eap6

  Version range not reported

• wss4j

  Version range not reported

• ws-scout

  Version range not reported

• xalan-j2-eap6

  Version range not reported

• xerces-j2-eap6

  Version range not reported

• xml-commons-resolver-eap6

  Version range not reported

• xml-security

  Version range not reported

• xom

  Version range not reported

• org.jboss.eap-jboss-eap-parent

  Version range not reported

• org.jboss.eap-jboss-eap-parent

  Version range not reported

• org.jboss.eap-jboss-eap-parent

  Version range not reported

References 8