Weakness · Medium
CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods
What it is
If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the product.
- Severity (our rating)
- Medium
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
If the EJB deployment descriptor contains one or more method permissions that grant access to the special ANYONE role, it indicates that access control for the application has not been fully thought through or that the application is structured in such a way that reasonable access control restrictions are impossible.
What an attacker can do
- Other (Other)
How to prevent it
Architecture and Design
- Follow the principle of least privilege when assigning access rights to EJB methods. Permission to invoke EJB methods should not be granted to the ANYONE role.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.