Some security issues have been reported in JBoss Enterprise SOA Platform, which can be exploited by malicious users to gain escalated privileges and by malicious people to bypass certain security restrictions.

1) An error in the handling of authentication request can potentially be exploited to gain escalated privileges.

For more information:
SA40568

2) The default configuration of the "web-console", "http-invoker", "gpd-deployer", "jbpm-console", "contract", and "uddi-console" allow to bypass security restrictions of the application via specially crafted HTTP requests.

Solution
Update to version 5.0.2.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://www.redhat.com/docs/en-US/JBoss_SOA_Platform/5.0.2/html/5.0.2_Release_Notes/index.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers