Threats tagged 'ghsa-2j35-g96f-m27g'

An authentication bypass vulnerability exists in Apache TomEE when an EJB JAX-WS endpoint is published within an existing web application. The authentication configured in the TomEE deployment descriptor is not enforced, allowing remote unauthenticated attackers to invoke web service operations unless additional security constraints are applied by the application. Upgrading to TomEE versions 10.3.0 or 11.0.0-M2 addresses this issue.