org.wildfly:wildfly-ejb3@8.0.0.Alpha4 vulnerabilities
latest version
34.0.1.Final
latest non vulnerable version
first published
11 years ago
latest version published
1 months ago
licenses detected
- [8.0.0.Alpha1,11.0.0.CR1)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.wildfly:wildfly-ejb3 package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.wildfly:wildfly-ejb3 is a WildFly Application Server Affected versions of this package are vulnerable to Improper Access Control when returning an incorrect caller principal under certain heavily concurrent situations when Elytron Security is used. This flaw allows an attacker to gain improper access to information they should not have. Note: JBoss EAP 7.1 until 7.4 is not affected by default as it comes with Legacy Security enabled out-of-the-box. How to fix Improper Access Control? Upgrade | [,26.1.1.Final)[27.0.0.Alpha1,27.0.0.Alpha2) |
org.wildfly:wildfly-ejb3 is a WildFly Application Server Affected versions of this package are vulnerable to Access Restriction Bypass. The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. How to fix Access Restriction Bypass? Upgrade | [8.0.0.Alpha1,8.0.0.CR1) |
org.wildfly:wildfly-ejb3 is a WildFly Application Server Affected versions of this package are vulnerable to Access Restriction Bypass. The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133. How to fix Access Restriction Bypass? Upgrade | [8.0.0.Alpha1,8.1.0.CR1) |