Description
The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | antlr-eap6 | 2.7.7-18.redhat_4.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.14-1.redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | glassfish-jsf-eap6 | 2.1.28-6.redhat_7.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | guava-libraries | 13.0.1-4.redhat_2.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.17-2.SP1_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.21.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | httpserver | 1.0.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-as-ee +53 | 7.4.3-3.Final_redhat_2.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.28-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-hal +1 | 2.2.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.4.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.3.5-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.3.4-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.3.6-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jbossas-core +8 | 7.4.3-2.Final_redhat_2.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.26-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jbossweb | 7.4.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.3.4-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jbossws-spi | 2.3.1-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.19-10.SP10_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | picketlink-bindings | 2.5.3-15.SP16_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.5.3-16.SP16_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.8-13.SP4_redhat_2.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | sun-istack-commons | 1:2.6.1-12.redhat_3.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | sun-saaj-1.3-impl | 1.3.16-11.SP1_redhat_2.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.28-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.17-2.SP1_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
Advisories 3
- RHSA-2015:0217 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:0218 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:0216 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2015:0850 vendor-advisory
- RHSA-2015:0215 vendor-advisory
- RHSA-2015:0851 vendor-advisory
- RHSA-2015:0217 vendor-advisory
- RHSA-2015:0218 vendor-advisory
- RHSA-2015:0216 vendor-advisory
- redhat-jboss-cve20147827-sec-bypass(100889) vdb-entry
- 1031741 vdb-entry