CVE-2014-7827

CVE-2014-7827 describes an access restriction bypass vulnerability in the JBoss Security component of Red Hat JBoss Enterprise Application Platform (EAP) before version 6.3.3. The vulnerability arises because the JBossMappingManager implementation defaults to the standard security domain when one is not explicitly defined. This allows remote authenticated users to bypass intended access restrictions by leveraging credentials from the default domain for roles also present in the application domain. The vulnerability has a CVSS score of 3.5 (Medium), indicating a network-based attack with medium complexity requiring authentication, resulting in a partial impact to integrity. Its EPSS score is very low, suggesting a low probability of exploitation. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with the majority of reported vulnerabilities.