Threats tagged 'ghsa-52g3-qw9c-qp2m'

A vulnerability exists in the internal system EJBs used for remote deployment and configuration when the server runs with the default profile. These EJBs do not enforce their administrative role check, allowing a remote unauthenticated attacker who can reach the remote EJB endpoint to deploy arbitrary applications and execute code. Only installations with enabled system applications and a remote EJB endpoint are affected. Upgrading to versions 10.3.0 or 11.0.0-M2 addresses this issue.