[jboss-jira] [JBoss JIRA] (WFCORE-540) CVE-2014-7849 WildFly Domain Management: Limited RBAC authorization bypass

CVE-2014-7849 WildFly Domain Management: Limited RBAC authorization bypass -------------------------------------------------------------------------- Key: WFCORE-540 URL: https://issues.jboss.org/browse/WFCORE-540 Project: WildFly Core Issue Type: Bug Components: Domain Management Affects Versions: 1.0.0.Alpha1 Reporter: Brian Stansberry Assignee: Brian Stansberry Fix For: 1.0.0.Alpha18 It was discovered that the Role Based Access Control (RBAC) implementation did not sufficiently verify all authorization conditions that are required by the Maintainer role to perform certain administrative actions. An authenticated user with the Maintainer role could use this flaw to add, modify, or undefine a limited set of attributes and their values, which otherwise cannot be written to.