CVE-2022-0866
- Source
- https://cve.org/CVERecord?id=CVE-2022-0866
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-0866.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-0866
- Aliases
- Downstream
- Published
- 2022-05-10T20:20:35Z
- Modified
- 2026-06-15T12:16:56.627119014Z
- Summary
- [none]
- Details
-
This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0866.json", "cna_assigner": "redhat", "unresolved_ranges": [ { "extracted_events": [ { "last_affected": "JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled." } ], "source": "AFFECTED_FIELD" } ], "cwe_ids": [ "CWE-863" ] }- References
Affected packages
Git / github.com/wildfly/wildfly
Affected ranges
- Type
- GIT
- Repo
- https://github.com/wildfly/wildfly
- Events
-
IntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affected
- Database specific
{ "extracted_events": [ { "introduced": "11.0.0" }, { "fixed": "26.1.1" }, { "introduced": "0" }, { "last_affected": "27.0.0-alpha1" } ], "cpe": [ "cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:wildfly:27.0.0:alpha1:*:*:*:*:*:*" ], "source": [ "CPE_RANGE", "CPE_STRING" ] }