CVE-2014-7827

Security: Wrong security context loaded when using SAML2 STS Login Module

Published Feb 13, 2015 CVSS 2.0 · 3.5 Low EPSS 1.7% KEV · Not listed
Description
The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2014-7693 The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 1:03 PM
Reserved
Oct 3, 2014, 12:00 AM
Status
Modified
Published
Feb 13, 2015, 3:59 PM
Modified
Jun 17, 2026, 12:15 AM
Severity
Low
Public date
Feb 11, 2015, 12:00 AM