CVE-2014-0018 Missing authorization in n/a
Local attackers can modify the server via crafted deployments due to improper access restrictions in the MSC service registry when a security manager is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0018?
CVE-2014-0018 is a low-severity missing authorization vulnerability in Redhat Jboss Enterprise Application Platform, published on 14 Feb 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry, which allows local users to modify the server via a crafted deployment.
Weakness: CWE-264
Which versions are affected by CVE-2014-0018?
It affects 2 products.
Products include Redhat Jboss Enterprise Application Platform, Redhat Jboss Wildfly Application Server.
How do I fix CVE-2014-0018?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2014-0018 being exploited?
There is no known exploitation of CVE-2014-0018 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution
- CVE-2010-1428 Red Hat JBoss Information Disclosure
- CVE-2010-0738 Red Hat JBoss Authentication Bypass
- CVE-2016-3690 Deserialization in n/a
- CVE-2017-7504 Deserialization in JBoss
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-mxv4-hqqr-c5rm.