CVE-2014-3472

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

Metrics

CVSS 2.0 4.9/10AV:N/AC:M/Au:S/C:P/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2014-1019.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1020.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1021.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0720.htmlVendor Advisory
http://www.securityfocus.com/bid/69094
https://bugzilla.redhat.com/show_bug.cgi?id=1103815
https://exchange.xforce.ibmcloud.com/vulnerabilities/95170
http://rhn.redhat.com/errata/RHSA-2014-1019.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1020.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1021.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0720.htmlVendor Advisory
http://www.securityfocus.com/bid/69094
https://bugzilla.redhat.com/show_bug.cgi?id=1103815
https://exchange.xforce.ibmcloud.com/vulnerabilities/95170

Timeline

Published: Aug 19, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-34734.3Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (H CVE-2014-34743.5Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboar CVE-2014-34753.5Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2 CVE-2014-34766.0OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, w CVE-2014-34774.0The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instea CVE-2014-34786.5Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.CVE-2014-34794.3The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5 CVE-2014-34806.5The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, d CVE-2014-34815.0org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity CVE-2014-34827.5SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active CVE-2014-34837.5SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active CVE-2014-34849.8Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1