CVE-2014-3464

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.

• CWE-264

• http://rhn.redhat.com/errata/RHSA-2014-1019.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1020.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1021.htmlVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1102317
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95409
• http://rhn.redhat.com/errata/RHSA-2014-1019.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1020.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1021.htmlVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1102317
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95409

Published

Aug 19, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3456Cross-site scripting (XSS) vulnerability in GitLab Enterpris…
• CVE-2014-3459Heap-based buffer overflow in SolarWinds Network Configurati…
• CVE-2014-3460Directory traversal vulnerability in the DumpToFile method i…
• CVE-2014-3461hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execut…
• CVE-2014-3462The ".encfs6.xml" configuration file in encfs before 1.7.5 a…7.5
• CVE-2014-3463Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-3465The gnutls_x509_dn_oid_name function in lib/x509/common.c in…
• CVE-2014-3466Buffer overflow in the read_server_hello function in lib/gnu…
• CVE-2014-3467Multiple unspecified vulnerabilities in the DER decoder in G…
• CVE-2014-3468The asn1_get_bit_der function in GNU Libtasn1 before 3.6 doe…
• CVE-2014-3469The (1) asn1_read_value_type and (2) asn1_read_value functio…
• CVE-2014-3470The ssl3_send_client_key_exchange function in s3_clnt.c in O…