CVE-2014-3472: The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat...

Security readout for executives and security teams

This flaw is an authorization bypass in JBoss AS 7 as used by Red Hat JBoss Enterprise Application Platform 6.3.0. An authenticated remote user may be treated as having roles they should not have, allowing access to restricted functions. Public details do not specify the exact vectors, severity score, or affected configurations beyond the listed product context. Exposure is most likely in environments running JBoss AS 7 through Red Hat JBoss Enterprise Application Platform 6.3.0, especially applications relying on container role checks for authorization. The bundle does not prove broader product or version impact. Prioritize normal vulnerability management for internet-facing or multi-user JBEAP 6.3.0 systems. Escalate if the platform protects privileged workflows, sensitive records, or tenant boundaries. Current evidence does not support emergency treatment based on active exploitation. Mitigation focus: Identify JBoss AS 7 and JBEAP 6.3.0 deployments.; Review the cited Red Hat advisories for applicable fixed packages.; Apply vendor-supported updates or maintenance releases where available..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.