Read the docs
TI-2016-07118 Aliases CVE-2016-8656GHSA-v2jx-53jj-4vjf

Improper access control in jbossas

Priority LOW 34CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 9 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-284.

Summary

Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result in local privilege escalation.

Why it matters now

EPSS 0.00346 28th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 9 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JBossjbossasjbossas 5.2.0-23; jbossas 6.4.13; jbossas 7.0.5—No fix listedCNA
  • jbossas VendorJBoss Affected jbossas 5.2.0-23; jbossas 6.4.13; jbossas 7.0.5 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*7.1.0VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat

Remediation

Red Hat 11 advisories

  • RHSA-2018:1609 Released 2018-05-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jbossas-5.2.0-23.ep5.el5, jbossas-client-5.2.0-23.ep5.el5, jbossas-messaging-5.2.0-23.ep5.el5 +1
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jbossas-5.2.0-23.ep5.el6, jbossas-client-5.2.0-23.ep5.el6, jbossas-messaging-5.2.0-23.ep5.el6 +1
  • RHSA-2017:3458 Released 2017-12-13 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el7
  • RHSA-2017:3455 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el7 +47
Show 8 more Red Hat advisories
  • RHSA-2017:3454 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el6 +47
  • RHSA-2017:0834 Released 2017-03-22 · Red Hat rating Important
    jboss-ec2-eap package for EAP 7.0.5
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.5-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.5-1.GA_redhat_1.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.5-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.5-1.GA_redhat_1.ep7.el7
  • RHSA-2017:0831 Released 2017-03-22 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.0.5 on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-16.SP19_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-16.SP19_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-16.SP19_redhat_1.1.ep7.el6 +47
  • RHSA-2017:0832 Released 2017-03-22 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.0.5 on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-16.SP19_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-16.SP19_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-16.SP19_redhat_1.1.ep7.el7 +47
  • RHSA-2017:0250 Released 2017-02-02 · Red Hat rating Important
    jboss-ec2-eap security, bug fix, and enhancement update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.13-1.Final_redhat_2.ep6.el6, jboss-ec2-eap-samples-7.5.13-1.Final_redhat_2.ep6.el6
  • RHSA-2017:0244 Released 2017-02-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-cxf-2.7.18-5.SP4_redhat_1.1.ep6.el6, hornetq-2.3.25-18.SP16_redhat_1.1.ep6.el6, infinispan-5.2.20-1.Final_redhat_1.1.ep6.el6 +47
  • RHSA-2017:0245 Released 2017-02-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server apache-cxf-2.7.18-5.SP4_redhat_1.1.ep6.el7, hornetq-2.3.25-18.SP16_redhat_1.1.ep6.el7, infinispan-5.2.20-1.Final_redhat_1.1.ep6.el7 +47
  • RHSA-2017:0246 Released 2017-02-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-cxf-2.7.18-5.SP4_redhat_1.1.ep6.el5, hornetq-2.3.25-18.SP16_redhat_1.1.ep6.el5, infinispan-5.2.20-1.Final_redhat_1.1.ep6.el5 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2018:1609
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2018:1609
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2017:0246
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2017:0244, RHSA-2017:0250
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2017:0245
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2017:0831, RHSA-2017:0834
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2017:0832, RHSA-2017:0834
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2017:3454, RHSA-2017:3458
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2017:3455, RHSA-2017:3458

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-8656
  2. 2026-10-03 Alias added: GHSA-v2jx-53jj-4vjf

References

Advisory 12

  • TI-2007-01004 The default configuration of JBoss does not restrict access to the (1) console and (2)… CVSS 2.0HIGH 7.5
  • TI-2008-03135 JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0… CVSS 2.0MEDIUM 5.0
  • TI-2018-00962 Infinite loop in Red Hat jboss-remoting CVSS 3.0HIGH 7.5
  • TI-2003-00780 Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x… CVSS 2.0HIGH 7.5
  • TI-2006-05535 Directory traversal vulnerability in the DeploymentFileRepository class in JBoss… CVSS 2.0HIGH 7.5
  • TI-2007-06139 The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x… CVSS 2.0HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences