Verified in JBoss EAP 6.4.0.ER1.
Ivo Studensky <istudens> updated the status of jira SECURITY-868 to Reopened