CVE-2014-3472

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

• CWE-264

• http://rhn.redhat.com/errata/RHSA-2014-1019.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1020.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1021.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.htmlVendor Advisory
• http://www.securityfocus.com/bid/69094
• https://bugzilla.redhat.com/show_bug.cgi?id=1103815
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95170
• http://rhn.redhat.com/errata/RHSA-2014-1019.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1020.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1021.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.htmlVendor Advisory
• http://www.securityfocus.com/bid/69094
• https://bugzilla.redhat.com/show_bug.cgi?id=1103815
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95170

Published

Aug 19, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3466Buffer overflow in the read_server_hello function in lib/gnu…
• CVE-2014-3467Multiple unspecified vulnerabilities in the DER decoder in G…
• CVE-2014-3468The asn1_get_bit_der function in GNU Libtasn1 before 3.6 doe…
• CVE-2014-3469The (1) asn1_read_value_type and (2) asn1_read_value functio…
• CVE-2014-3470The ssl3_send_client_key_exchange function in s3_clnt.c in O…
• CVE-2014-3471Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Q…
• CVE-2014-3473Cross-site scripting (XSS) vulnerability in the Orchestratio…
• CVE-2014-3474Cross-site scripting (XSS) vulnerability in horizon/static/h…
• CVE-2014-3475Cross-site scripting (XSS) vulnerability in the Users panel …
• CVE-2014-3476OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before…
• CVE-2014-3477The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1…4
• CVE-2014-3478Buffer overflow in the mconvert function in softmagic.c in f…6.5