CWE-9 – J2EE Misconfiguration: Weak Access Permissions for EJB Methods | Common Weakness Enumeration (CWE)

Overview

CWE-9 (J2EE Misconfiguration: Weak Access Permissions for EJB Methods) documents a weakness type used across vulnerability databases and security assessments. Use the sections below for definition, context, and mapped CVEs.

Security impact: Security impact: Depends on product and context; use CVE records, severity scores, and MITRE guidance to prioritize.

Description

If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the product.

Applicable platforms

Kind	Name	Class	Prevalence	OS / CPE
language	Java	—	Undetermined	—

Previous names

J2EE Misconfiguration: Weak Access Permissions (2008-04-11)

Content submission

Name: 7 Pernicious Kingdoms
Date: 2006-07-19
Version: Draft 3

Content modifications

Date	Name	Version	Importance	Comment
2008-07-01	Eric Dalci	1.0	—	updated Time_of_Introduction
2008-09-08	CWE Content Team	1.0	—	updated Relationships, Other_Notes, Taxonomy_Mappings
2009-03-10	CWE Content Team	1.3	—	updated Relationships
2009-07-27	CWE Content Team	1.5	—	updated Demonstrative_Examples
2011-06-01	CWE Content Team	1.13	—	updated Common_Consequences
2012-05-11	CWE Content Team	2.2	—	updated Relationships
2012-10-30	CWE Content Team	2.3	—	updated Potential_Mitigations
2014-06-23	CWE Content Team	2.7	—	updated Description, Other_Notes
2020-02-24	CWE Content Team	4.0	—	updated References, Relationships
2023-01-31	CWE Content Team	4.10	—	updated Description
2023-04-27	CWE Content Team	4.11	—	updated Relationships
2023-06-29	CWE Content Team	4.12	—	updated Mapping_Notes
2025-12-11	CWE Content Team	4.19	—	updated Applicable_Platforms, Weakness_Ordinalities