A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user and password. The highest threat to vulnerability is to system availability.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jboss_enterprise_application_platform | Redhat | * | 5.0.3 (excluding) |
| Openshift_application_runtimes | Redhat | - (including) | - (including) |
| Single_sign-on | Redhat | 7.0 (including) | 7.0 (including) |
| EAP 7.3.3 | RedHat | picketbox | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-activemq-artemis-0:2.9.0-5.redhat_00011.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-activemq-artemis-native-1:1.0.2-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-apache-commons-codec-0:1.14.0-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-apache-commons-lang-0:3.10.0-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-apache-cxf-0:3.3.7-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-artemis-native-1:1.0.2-3.redhat_1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-bouncycastle-0:1.65.0-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-glassfish-jsf-0:2.3.9-11.SP12_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-hal-console-0:3.2.10-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-hibernate-0:5.3.18-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-httpcomponents-client-0:4.5.12-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-httpcomponents-core-0:4.4.13-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jberet-0:1.3.7-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jboss-invocation-0:1.5.3-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jboss-logmanager-0:2.1.17-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jboss-server-migration-0:1.7.2-2.Final_redhat_00002.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jboss-xnio-base-0:3.7.9-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jgroups-0:4.1.10-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-narayana-0:5.9.9-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-picketbox-0:5.0.3-8.Final_redhat_00007.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-picketlink-bindings-0:2.5.5-25.SP12_redhat_00013.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-snakeyaml-0:1.26.0-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-undertow-0:2.0.31-1.SP1_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-velocity-0:2.2.0-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-wildfly-0:7.3.3-4.GA_redhat_00004.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-wildfly-elytron-0:1.10.8-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-wildfly-transaction-client-0:1.1.13-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-ws-commons-XmlSchema-0:2.2.5-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-xerces-j2-0:2.12.0-2.SP03_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-activemq-artemis-0:2.9.0-5.redhat_00011.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-activemq-artemis-native-1:1.0.2-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-apache-commons-codec-0:1.14.0-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-apache-commons-lang-0:3.10.0-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-apache-cxf-0:3.3.7-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-artemis-native-1:1.0.2-3.redhat_1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-bouncycastle-0:1.65.0-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-glassfish-jsf-0:2.3.9-11.SP12_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-hal-console-0:3.2.10-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-hibernate-0:5.3.18-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-httpcomponents-client-0:4.5.12-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-httpcomponents-core-0:4.4.13-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jberet-0:1.3.7-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jboss-invocation-0:1.5.3-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jboss-logmanager-0:2.1.17-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jboss-server-migration-0:1.7.2-2.Final_redhat_00002.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jboss-xnio-base-0:3.7.9-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jgroups-0:4.1.10-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-narayana-0:5.9.9-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-picketbox-0:5.0.3-8.Final_redhat_00007.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-picketlink-bindings-0:2.5.5-25.SP12_redhat_00013.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-snakeyaml-0:1.26.0-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-undertow-0:2.0.31-1.SP1_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-velocity-0:2.2.0-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-wildfly-0:7.3.3-4.GA_redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-wildfly-elytron-0:1.10.8-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-wildfly-transaction-client-0:1.1.13-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-ws-commons-XmlSchema-0:2.2.5-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-xerces-j2-0:2.12.0-2.SP03_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-activemq-artemis-0:2.9.0-5.redhat_00011.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-activemq-artemis-native-1:1.0.2-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-apache-commons-codec-0:1.14.0-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-apache-commons-lang-0:3.10.0-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-apache-cxf-0:3.3.7-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-artemis-native-1:1.0.2-3.redhat_1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-bouncycastle-0:1.65.0-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-glassfish-jsf-0:2.3.9-11.SP12_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-hal-console-0:3.2.10-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-hibernate-0:5.3.18-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-httpcomponents-client-0:4.5.12-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-httpcomponents-core-0:4.4.13-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jberet-0:1.3.7-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jboss-invocation-0:1.5.3-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jboss-logmanager-0:2.1.17-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jboss-server-migration-0:1.7.2-2.Final_redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jboss-xnio-base-0:3.7.9-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jgroups-0:4.1.10-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-narayana-0:5.9.9-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-picketbox-0:5.0.3-8.Final_redhat_00007.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-picketlink-bindings-0:2.5.5-25.SP12_redhat_00013.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-snakeyaml-0:1.26.0-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-undertow-0:2.0.31-1.SP1_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-velocity-0:2.2.0-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-wildfly-0:7.3.3-4.GA_redhat_00004.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-wildfly-elytron-0:1.10.8-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-wildfly-transaction-client-0:1.1.13-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-ws-commons-XmlSchema-0:2.2.5-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-xerces-j2-0:2.12.0-2.SP03_redhat_00001.1.el8eap | * |
| Red Hat Single Sign-On 7.4.3 | RedHat | picketbox | * |
| Text-Only RHOAR | RedHat | * |