CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the product.
扩展描述
If the EJB deployment descriptor contains one or more method permissions that grant access to the special ANYONE role, it indicates that access control for the application has not been fully thought through or that the application is structured in such a way that reasonable access control restrictions are impossible.
常见后果
影响范围: Other
技术影响: Other
潜在缓解措施
阶段: Architecture and Design System Configuration
描述: Follow the principle of least privilege when assigning access rights to EJB methods. Permission to invoke EJB methods should not be granted to the ANYONE role.
引入模式
| 阶段 | 说明 |
|---|---|
| Architecture and Design | - |
| Implementation | - |
分类映射
| 分类名称 | 条目ID | 条目名称 | 映射适配度 |
|---|---|---|---|
| 7 Pernicious Kingdoms | - | J2EE Misconfiguration: Weak Access Permissions | - |