Description
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | antlr-eap6 | 2.7.7-17.redhat_4.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | apache-commons-beanutils | 1.8.3-13.redhat_6.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | apache-commons-cli | 1.2-8.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | apache-commons-configuration | 1.6-8.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | apache-commons-daemon-eap6 | 1:1.0.15-5.redhat_1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | apache-commons-pool-eap6 | 1.6-7.redhat_6.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.7-1.redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | apache-mime4j | 0.6-8.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | atinject-eap6 | 1-5.redhat_4.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | dom4j-eap6 | 1.6.1-20.redhat_6.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | glassfish-jaxb-eap6 | 2.2.5-17.redhat_7.2.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | glassfish-jsf-eap6 | 2.1.19-2.3.redhat_2.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | glassfish-jsf12-eap6 | 1.2_15-5.b01_redhat_8.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | gnu-getopt | 1.0.13-3.redhat_4.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.7-3.3.SP1_redhat_3.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | hornetq-native +1 | 2.3.8-1.Final_redhat_1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | httpserver | 1.0.1-4.Final_redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.7-2.Final_redhat_2.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.23-1.3.Final_redhat_1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jacorb-jboss | 2.3.2-12.redhat_5.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jansi | 1.9-5.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | javassist-eap6 | 3.18.1-1.GA_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jaxen | 1.1.3-9.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbosgi-metadata | 2.2.0-2.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-aesh | 0.33.8-1.redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-as-cli | 7.3.0-5.Final_redhat_14.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-as-ee +49 | 7.3.0-6.Final_redhat_14.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-dmr | 1.2.0-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.24-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-ejb3-ext-api | 2.1.0-1.redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-genericjms | 1.0.1-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-hal +1 | 2.0.6-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-jacc-api_1.4_spec | 1.0.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-logmanager | 1.5.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.4.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.3.0-2.Final_redhat_2.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.2.18-1.GA_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-remoting3-jmx | 1.1.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.2.6-2.Final_redhat_1.2.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-security-xacml | 2.0.8-10.Final_redhat_5.2.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-threads | 2.1.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-vfs2 | 3.2.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jboss-weld-1.1-api | 1.1-8.Final_redhat_4.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossas-appclient | 7.3.0-8.Final_redhat_14.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossas-core +6 | 7.3.0-7.Final_redhat_14.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossas-domain | 7.3.0-22.Final_redhat_14.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.3.0-14.Final_redhat_14.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.3.0-21.Final_redhat_14.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.15-4.Final_redhat_4.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossws-api | 1.0.2-1.Final_redhat_1.2.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossws-common | 2.2.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossws-common-tools | 1.2.0-2.Final_redhat_2.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.2.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossws-native | 4.1.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jbossws-spi | 2.2.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jcip-annotations-eap6 | 1.0-5.redhat_6.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jdom-eap6 | 1.1.2-5.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jettison | 1.3.1-8.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | juddi | 3.1.3-4.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | mod_cluster +1 | 1.2.6-2.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | mod_cluster-native | 1.2.6-1.Final.redhat_1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | mod_jk +1 | 1.2.37-4.redhat_3.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | objectweb-asm-eap6 | 3.3.1-6.3.redhat_5.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | opensaml | 2.5.3-3.redhat_2.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | openws | 1.4.4-2.redhat_2.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | org.apache.felix.configadmin | 1.2.8-7.redhat_4.2.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | org.apache.felix.log | 1.0.0-6.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | org.osgi-eap6 +2 | 4.2.0-11.10.redhat_4.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.19-1.SP2_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.1.9-3.SP2_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.7-2.Final_redhat_2.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | scannotation | 1.0.3-2.redhat_4.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | shrinkwrap +4 | 1.1.2-3.redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | slf4j +1 | 1.7.2-11.redhat_2.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | stilts | 0.1.26-10.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | sun-ws-metadata-2.0-api | 1.0.MR1-16_MR1_redhat_6.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | velocity-eap6 | 1.7-4.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | weld-cdi-1.0-api | 1.0-9.SP4.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.16-3.Final_redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | ws-commons-XmlSchema | 2.0.2-8.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | ws-commons-neethi | 3.0.2-6.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | ws-scout | 1.2.6-4.redhat_3.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | wsdl4j-eap6 | 1.6.2-14.redhat_6.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.12-1.redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | xerces-j2-eap6 | 2.9.1-16.redhat_5.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | xjc-utils +4 | 2.6.1-4.redhat_2.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | xml-commons-resolver-eap6 | 1.2-16.redhat_9.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | xml-security | 1.5.5-2.redhat_2.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | xmltooling | 1.3.4-3.redhat_1.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
| Red Hat JBoss EAP 6 | xom | 1.2.7-2.redhat_4.1.ep6.el5 | RHSA-2013:1786, RHSA-2013:1785 |
Advisories 2
- RHSA-2013:1786 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:1785 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2015:0850 vendor-advisory
- RHSA-2013:1785 vendor-advisory
- 1029431 vdb-entry
- RHSA-2015:0851 vendor-advisory
- RHSA-2013:1784 vendor-advisory
- RHSA-2013:1786 vendor-advisory