Bug 479668 - (CVE-2009-0027) CVE-2009-0027 JBoss EAP unprivileged local xml file access
CVE-2009-0027 JBoss EAP unprivileged local xml file access
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
https://jira.jboss.org/jira/browse/JB...
source=redhat,public=20090306,reporte...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-01-12 07:37 EST by Marc Schoenefeld
Modified: 2013-07-29 04:01 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-07-29 04:01:23 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Comment 2 Marc Schoenefeld 2009-03-06 08:01:07 EST
The request handler in JBossWS does not correctly verify the resource path
when serving WSDL files for custom web service endpoints. This allows
remote attackers to read arbitrary XML files with the permissions of the
EAP process.

Note You need to log in before you can comment on or make changes to this bug.