Variant weakness
Draft
CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods
If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the product.
Last updated
0
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
If the EJB deployment descriptor contains one or more method permissions that grant access to the special ANYONE role, it indicates that access control for the application has not been fully thought through or that the application is structured in such a way that reasonable access control restrictions are impossible.
Common consequences
What can happen when CWE-9 is exploited.
Other
Affects: Other
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Architecture and Design
Implementation
Applies to
Languages
Java
How to prevent it
Practical mitigations for CWE-9, grouped by where in the lifecycle they apply.
Architecture and Design