Description
Red Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce "modify resource" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=760024
- RHSA-2012:0089 vendor-advisory