Description
Cosminexus Manager in Cosminexus Application Server 06-50 and later might assign the wrong user's group permissions to logical J2EE server processes, which allows local users to gain privileges.
References
- 37854 vdb-entry
- http://www.hitachi-support.com/security_e/vuls_e/HS07-025_e/index-e.html
- 25434 vdb-entry
- 26589 third-party-advisory
- cosminexus-group-security-bypass(36245) vdb-entry