Vulnerability-Lookup

CVE-2014-7827 (GCVE-0-2014-7827)

Vulnerability from cvelistv5 – Published: 2015-02-13 15:00 – Updated: 2024-08-06 13:03

Summary

The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

8 references

URL	Tags
http://rhn.redhat.com/errata/RHSA-2015-0850.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-0215.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-0851.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-0217.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-0218.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-0216.html	vendor-advisoryx_refsource_REDHAT
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.securitytracker.com/id/1031741	vdb-entryx_refsource_SECTRACK

Date Public

2015-02-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:03:27.112Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2015:0850",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0850.html"
          },
          {
            "name": "RHSA-2015:0215",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0215.html"
          },
          {
            "name": "RHSA-2015:0851",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0851.html"
          },
          {
            "name": "RHSA-2015:0217",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0217.html"
          },
          {
            "name": "RHSA-2015:0218",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0218.html"
          },
          {
            "name": "RHSA-2015:0216",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0216.html"
          },
          {
            "name": "redhat-jboss-cve20147827-sec-bypass(100889)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100889"
          },
          {
            "name": "1031741",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031741"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-07T15:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2015:0850",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0850.html"
        },
        {
          "name": "RHSA-2015:0215",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0215.html"
        },
        {
          "name": "RHSA-2015:0851",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0851.html"
        },
        {
          "name": "RHSA-2015:0217",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0217.html"
        },
        {
          "name": "RHSA-2015:0218",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0218.html"
        },
        {
          "name": "RHSA-2015:0216",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0216.html"
        },
        {
          "name": "redhat-jboss-cve20147827-sec-bypass(100889)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100889"
        },
        {
          "name": "1031741",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031741"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-7827",
    "datePublished": "2015-02-13T15:00:00.000Z",
    "dateReserved": "2014-10-03T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:03:27.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-7827",
      "date": "2026-09-17",
      "epss": "0.01739",
      "percentile": "0.76602"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"6.3.2\", \"matchCriteriaId\": \"B2AC9D55-C1C7-4BAB-8D1E-F2413B19FA4C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.\"}, {\"lang\": \"es\", \"value\": \"La implementaci\\u00f3n org.jboss.security.plugins.mapping.JBossMappingManager en JBoss Security en Red Hat JBoss Enterprise Application Platform (EAP) anterior a 6.3.3 utiliza el dominio de seguridad por defecto cuando un dominio de seguridad no est\\u00e1 definido, lo que permite a usuarios remotos autenticados evadir las restricciones de acceso mediante el aprovechamiento de las credenciales en el dominio por defecto para un rol que tambi\\u00e9n est\\u00e1 en el dominio de la aplicaci\\u00f3n.\"}]",
      "id": "CVE-2014-7827",
      "lastModified": "2024-11-21T02:18:05.453",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:N/I:P/A:N\", \"baseScore\": 3.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.8, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2015-02-13T15:59:04.263",
      "references": "[{\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0215.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0216.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0217.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0218.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0850.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0851.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.securitytracker.com/id/1031741\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/100889\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0215.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0216.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0217.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0218.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0850.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0851.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securitytracker.com/id/1031741\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/100889\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-7827\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2015-02-13T15:59:04.263\",\"lastModified\":\"2026-05-06T22:30:45.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.\"},{\"lang\":\"es\",\"value\":\"La implementaci\u00f3n org.jboss.security.plugins.mapping.JBossMappingManager en JBoss Security en Red Hat JBoss Enterprise Application Platform (EAP) anterior a 6.3.3 utiliza el dominio de seguridad por defecto cuando un dominio de seguridad no est\u00e1 definido, lo que permite a usuarios remotos autenticados evadir las restricciones de acceso mediante el aprovechamiento de las credenciales en el dominio por defecto para un rol que tambi\u00e9n est\u00e1 en el dominio de la aplicaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"6.3.2\",\"matchCriteriaId\":\"B2AC9D55-C1C7-4BAB-8D1E-F2413B19FA4C\"}]}]}],\"references\":[{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0215.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0216.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0217.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0218.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0850.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0851.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id/1031741\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/100889\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0215.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0216.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0217.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0218.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0850.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0851.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1031741\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/100889\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:17:07+00:00",
      "cve": "CVE-2014-7827",
      "id": "CVE-2014-7827",
      "initial_release_date": "2014-01-01T00:00:00+00:00",
      "product_status:fixed": "549",
      "product_status:known_affected": "12",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Security: Wrong security context loaded when using SAML2 STS Login Module",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2014/cve-2014-7827.json",
      "version": "3"
    }
  }
}

CNVD-2015-01250

Vulnerability from cnvd - Published: 2015-02-27

Title

Red Hat JBoss Enterprise Application Platform访问限制绕过漏洞

Description

Red Hat JBoss Enterprise Application Platform（EAP）是美国红帽（Red Hat）公司的一套开源、基于J2EE的中间件平台，它主要用于构建、部署和托管Java应用程序与服务。 Red Hat JBoss Enterprise Application Platform存在访问限制绕过漏洞，允许远程认证用户绕过预期的访问限制。

Severity

低

Patch Name

Red Hat JBoss Enterprise Application Platform访问限制绕过漏洞的补丁

Patch Description

Formal description

用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞：http://rhn.redhat.com/errata/RHSA-2015-0218.html

Reference

http://rhn.redhat.com/errata/RHSA-2015-0218.html http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7827

Impacted products

Name
Red Hat JBoss Enterprise Application Platform <6.3.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2014-7827"
    }
  },
  "description": "Red Hat JBoss Enterprise Application Platform\uff08EAP\uff09\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u3001\u57fa\u4e8eJ2EE\u7684\u4e2d\u95f4\u4ef6\u5e73\u53f0\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u6784\u5efa\u3001\u90e8\u7f72\u548c\u6258\u7ba1Java\u5e94\u7528\u7a0b\u5e8f\u4e0e\u670d\u52a1\u3002\r\n\r\nRed Hat JBoss Enterprise Application Platform\u5b58\u5728\u8bbf\u95ee\u9650\u5236\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u8ba4\u8bc1\u7528\u6237\u7ed5\u8fc7\u9884\u671f\u7684\u8bbf\u95ee\u9650\u5236\u3002",
  "discovererName": "unknown",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u53d6\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1ahttp://rhn.redhat.com/errata/RHSA-2015-0218.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-01250",
  "openTime": "2015-02-27",
  "patchDescription": "Red Hat JBoss Enterprise Application Platform\uff08EAP\uff09\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u3001\u57fa\u4e8eJ2EE\u7684\u4e2d\u95f4\u4ef6\u5e73\u53f0\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u6784\u5efa\u3001\u90e8\u7f72\u548c\u6258\u7ba1Java\u5e94\u7528\u7a0b\u5e8f\u4e0e\u670d\u52a1\u3002\r\n\r\nRed Hat JBoss Enterprise Application Platform\u5b58\u5728\u8bbf\u95ee\u9650\u5236\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u8ba4\u8bc1\u7528\u6237\u7ed5\u8fc7\u9884\u671f\u7684\u8bbf\u95ee\u9650\u5236\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Red Hat JBoss Enterprise Application Platform\u8bbf\u95ee\u9650\u5236\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Red Hat JBoss Enterprise Application Platform \u003c6.3.3"
  },
  "referenceLink": "http://rhn.redhat.com/errata/RHSA-2015-0218.html\r\nhttp://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7827",
  "serverity": "\u4f4e",
  "submitTime": "2015-02-21",
  "title": "Red Hat JBoss Enterprise Application Platform\u8bbf\u95ee\u9650\u5236\u7ed5\u8fc7\u6f0f\u6d1e"
}

FKIE_CVE-2014-7827

Vulnerability from fkie_nvd - Published: 2015-02-13 15:59 - Updated: 2026-06-17 00:15

Severity

Summary

References

URL	Tags
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2015-0215.html	Vendor Advisory
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2015-0216.html	Vendor Advisory
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2015-0217.html	Vendor Advisory
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2015-0218.html	Vendor Advisory
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2015-0850.html
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2015-0851.html
secalert@redhat.com	http://www.securitytracker.com/id/1031741
secalert@redhat.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/100889
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2015-0215.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2015-0216.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2015-0217.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2015-0218.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2015-0850.html
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2015-0851.html
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id/1031741
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/100889

Impacted products

	Vendor	Product	Version
	redhat	jboss_enterprise_application_platform	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2AC9D55-C1C7-4BAB-8D1E-F2413B19FA4C",
              "versionEndIncluding": "6.3.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain."
    },
    {
      "lang": "es",
      "value": "La implementaci\u00f3n org.jboss.security.plugins.mapping.JBossMappingManager en JBoss Security en Red Hat JBoss Enterprise Application Platform (EAP) anterior a 6.3.3 utiliza el dominio de seguridad por defecto cuando un dominio de seguridad no est\u00e1 definido, lo que permite a usuarios remotos autenticados evadir las restricciones de acceso mediante el aprovechamiento de las credenciales en el dominio por defecto para un rol que tambi\u00e9n est\u00e1 en el dominio de la aplicaci\u00f3n."
    }
  ],
  "id": "CVE-2014-7827",
  "lastModified": "2026-06-17T00:15:46.937",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-02-13T15:59:04.263",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0215.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0216.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0217.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0218.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0850.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0851.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securitytracker.com/id/1031741"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100889"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0215.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0216.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0217.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0218.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0850.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0851.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1031741"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100889"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-HGX6-Q6MP-88M2

Vulnerability from github – Published: 2022-05-17 01:14 – Updated: 2022-05-17 01:14

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-7827"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-02-13T15:59:00Z",
    "severity": "LOW"
  },
  "details": "The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.",
  "id": "GHSA-hgx6-q6mp-88m2",
  "modified": "2022-05-17T01:14:20Z",
  "published": "2022-05-17T01:14:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7827"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100889"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0215.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0216.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0217.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0218.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0850.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0851.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1031741"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2014-7827

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2014-7827

Aliases

CVE-2014-7827

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2014-7827",
    "description": "The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.",
    "id": "GSD-2014-7827",
    "references": [
      "https://access.redhat.com/errata/RHSA-2015:0851",
      "https://access.redhat.com/errata/RHSA-2015:0850",
      "https://access.redhat.com/errata/RHSA-2015:0218",
      "https://access.redhat.com/errata/RHSA-2015:0217",
      "https://access.redhat.com/errata/RHSA-2015:0216",
      "https://access.redhat.com/errata/RHSA-2015:0215"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-7827"
      ],
      "details": "The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.",
      "id": "GSD-2014-7827",
      "modified": "2023-12-13T01:22:47.124916Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2014-7827",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0850.html"
          },
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0851.html"
          },
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2015-0215.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0215.html"
          },
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2015-0216.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0216.html"
          },
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2015-0217.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0217.html"
          },
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2015-0218.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0218.html"
          },
          {
            "name": "http://www.securitytracker.com/id/1031741",
            "refsource": "MISC",
            "url": "http://www.securitytracker.com/id/1031741"
          },
          {
            "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100889",
            "refsource": "MISC",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100889"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[2-alpha0,2.5.3.SP13],[2.6-alpha0,2.6.1],[2.7-alpha0,2.7.1.Beta2]",
          "affected_versions": "All versions starting from 2-alpha0 up to 2.5.3.sp13, all versions starting from 2.6-alpha0 up to 2.6.1, all versions starting from 2.7-alpha0 up to 2.7.1.beta2",
          "cvss_v2": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-264",
            "CWE-937"
          ],
          "date": "2017-09-07",
          "description": "The `org.jboss.security.plugins.mapping.JBossMappingManager` implementation in this package uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.",
          "fixed_versions": [
            "2.5.3.SP14"
          ],
          "identifier": "CVE-2014-7827",
          "identifiers": [
            "CVE-2014-7827"
          ],
          "not_impacted": "All versions before 2-alpha0, all versions after 2.5.3.sp13 before 2.6-alpha0, all versions after 2.6.1 before 2.7-alpha0, all versions after 2.7.1.beta2",
          "package_slug": "maven/org.picketlink/picketlink-federation",
          "pubdate": "2015-02-13",
          "solution": "Upgrade to version 2.5.3.SP14 or above.",
          "title": "Wrong security context loaded when using SAML2 STS Login Module",
          "urls": [
            "https://bugzilla.redhat.com/CVE-2014-7827"
          ],
          "uuid": "ec2d86dc-22e0-487d-94c3-a1e0150dac25"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.3.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2014-7827"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-264"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1031741",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id/1031741"
            },
            {
              "name": "RHSA-2015:0217",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0217.html"
            },
            {
              "name": "RHSA-2015:0216",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0216.html"
            },
            {
              "name": "RHSA-2015:0218",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0218.html"
            },
            {
              "name": "RHSA-2015:0215",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0215.html"
            },
            {
              "name": "RHSA-2015:0851",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0851.html"
            },
            {
              "name": "RHSA-2015:0850",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0850.html"
            },
            {
              "name": "redhat-jboss-cve20147827-sec-bypass(100889)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100889"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 6.8,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2017-09-08T01:29Z",
      "publishedDate": "2015-02-13T15:59Z"
    }
  }
}

RHSA-2015:0215

Vulnerability from csaf_redhat - Published: 2015-02-11 20:06 - Updated: 2026-08-04 22:01

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2014-7827.

CVE-2014-7827

It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the expected application domain, could perform actions that were otherwise not available to them. When using the SAML2 STS Login Module, JBossMappingManager exposed this issue due to the PicketLink Trust SecurityActions implementation using a hardcoded default value when defining the context.

3.5 ()


                
                  AV:N/AC:M/Au:S/C:P/I:N/A:N

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2015:0215

Open the full advisory

RHSA-2015:0216

Vulnerability from csaf_redhat - Published: 2015-02-11 20:18 - Updated: 2026-08-04 22:01

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2014-7827.

CVE-2014-7827

3.5 ()


                
                  AV:N/AC:M/Au:S/C:P/I:N/A:N

Fixed: 182 products

https://access.redhat.com/errata/RHSA-2015:0216

Open the full advisory

RHSA-2015:0217

Vulnerability from csaf_redhat - Published: 2015-02-11 20:16 - Updated: 2026-08-04 22:01

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2014-7827.

CVE-2014-7827

3.5 ()


                
                  AV:N/AC:M/Au:S/C:P/I:N/A:N

Fixed: 182 products

https://access.redhat.com/errata/RHSA-2015:0217

Open the full advisory

RHSA-2015:0218

Vulnerability from csaf_redhat - Published: 2015-02-11 20:36 - Updated: 2026-08-04 22:01

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2014-7827.

CVE-2014-7827

3.5 ()


                
                  AV:N/AC:M/Au:S/C:P/I:N/A:N

Fixed: 182 products

https://access.redhat.com/errata/RHSA-2015:0218

Open the full advisory

RHSA-2015:0850

Vulnerability from csaf_redhat - Published: 2015-04-16 16:02 - Updated: 2026-08-08 18:03

Summary

Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.0 update

Severity

Important

Scope

16 vulnerabilities in this advisory, including CVE-2014-7827.

CVE-2014-7827

3.5 ()


                
                  AV:N/AC:M/Au:S/C:P/I:N/A:N

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2015:0850

Open the full advisory

RHSA-2015:0851

Vulnerability from csaf_redhat - Published: 2015-04-16 16:02 - Updated: 2026-08-08 18:03

Summary

Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.0 update

Severity

Important

Scope

16 vulnerabilities in this advisory, including CVE-2014-7827.

CVE-2014-7827

3.5 ()


                
                  AV:N/AC:M/Au:S/C:P/I:N/A:N

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2015:0851

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2014-7827 (GCVE-0-2014-7827)

Tags

Sightings

Nomenclature

Related by attack behaviour