CVE:CVE-2007-1354
CNNVD:CNNVD-200707-502
JMX Console in JBoss Application Server 4.0.2版本和4.0.5 20070416版本之前的版本的访问权控制功能(JMXOpsAccessControlFilter)运行一个自变量来储存现有用户的角色，这会允许远程验证管理员通过在于多个特权管理员会话的时候登录，触发一个竞争状态并获得特权，例如对Write Mode的Read Mode的特权升级。
solution:Upgrade jboss jboss_application_server to a higher version than 4.0.2.ga_cp02,4.0.2.ga_cp03,4.0.2.ga_cp04,4.0.5.ga,4.0.5_cp01,4.0.5_cp02,and avoid the version 4.0.2.ga_cp02,4.0.2.ga_cp03,4.0.2.ga_cp04,4.0.5.ga,4.0.5_cp01,4.0.5_cp02