Description
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | jboss-as-client-all | 7.2.0-9.Final_redhat_9.ep6.el5 | RHSA-2013:1151 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.21-2.Final_redhat_2.ep6.el5 | RHSA-2013:1151 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.6-3.Final_redhat_3.ep6.el5 | RHSA-2013:1151 |
Advisories 1
- RHSA-2013:1151 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.0 security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- RHSA-2013:1152 vendor-advisory
- eap-cve20134213-session-hijacking(86387) vdb-entry
- 96216 vdb-entry
- 54508 third-party-advisory
- RHSA-2013:1437 vendor-advisory
- 1028898 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=985359
- RHSA-2013:1151 vendor-advisory