CVE-2013-2133

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.

• CWE-264

• http://rhn.redhat.com/errata/RHSA-2013-1784.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1785.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1786.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0850.html
• http://rhn.redhat.com/errata/RHSA-2015-0851.html
• http://www.securitytracker.com/id/1029431
• http://rhn.redhat.com/errata/RHSA-2013-1784.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1785.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1786.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0850.html
• http://rhn.redhat.com/errata/RHSA-2015-0851.html
• http://www.securitytracker.com/id/1029431

Published

Dec 6, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-2127Buffer overflow in the exposure correction code in LibRaw be…
• CVE-2013-2128The tcp_read_sock function in net/ipv4/tcp.c in the Linux ke…5.5
• CVE-2013-2129Cross-site scripting (XSS) vulnerability in the Webform modu…
• CVE-2013-2130ZNC 1.0 allows remote authenticated users to cause a denial …
• CVE-2013-2131Format string vulnerability in the rrdtool module 1.4.7 for …
• CVE-2013-2132bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo…
• CVE-2013-2134Apache Struts 2 before 2.3.14.3 allows remote attackers to e…
• CVE-2013-2135Apache Struts 2 before 2.3.14.3 allows remote attackers to e…
• CVE-2013-2136Multiple cross-site scripting (XSS) vulnerabilities in Apach…
• CVE-2013-2137Cross-site scripting (XSS) vulnerability in the "View Log" s…
• CVE-2013-2138The (1) uploadify and (2) flowplayer SWF files in Gallery 3 …
• CVE-2013-2139Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earli…