CVE-2012-0034

The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2013-0197.html	Vendor Advisory
http://www.securityfocus.com/bid/51392
http://secunia.com/advisories/52054	Vendor Advisory
https://issues.jboss.org/browse/JBCACHE-1612
http://rhn.redhat.com/errata/RHSA-2013-0196.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0192.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0195.html	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=772835
http://secunia.com/advisories/51984	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-0108.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0193.html
http://rhn.redhat.com/errata/RHSA-2012-1072.html
http://rhn.redhat.com/errata/RHSA-2013-0191.html
http://rhn.redhat.com/errata/RHSA-2013-0221.html
http://www.osvdb.org/78259
http://rhn.redhat.com/errata/RHSA-2013-0533.html

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.1.2:::::::*

Configuration 3 (hide)

cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:*

Information

Published : 2013-02-05 15:55

Updated : 2015-01-17 18:59

NVD link : CVE-2012-0034

Mitre link : CVE-2012-0034

JSON object : View

CWE

CWE-255

Credentials Management Errors

Advertisement

Products Affected

redhat

jboss_enterprise_brms_platform
jboss_enterprise_web_platform
jboss_enterprise_application_platform

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html", "name": "RHSA-2013:0197", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.securityfocus.com/bid/51392", "name": "51392", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/52054", "name": "52054", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://issues.jboss.org/browse/JBCACHE-1612", "name": "https://issues.jboss.org/browse/JBCACHE-1612", "tags": [], "refsource": "CONFIRM"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html", "name": "RHSA-2013:0196", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html", "name": "RHSA-2013:0192", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html", "name": "RHSA-2013:0195", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=772835", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=772835", "tags": [], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/51984", "name": "51984", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://rhn.redhat.com/errata/RHSA-2012-0108.html", "name": "RHSA-2012:0108", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html", "name": "RHSA-2013:0193", "tags": [], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2012-1072.html", "name": "RHSA-2012:1072", "tags": [], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html", "name": "RHSA-2013:0191", "tags": [], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html", "name": "RHSA-2013:0221", "tags": [], "refsource": "REDHAT"}, {"url": "http://www.osvdb.org/78259", "name": "78259", "tags": [], "refsource": "OSVDB"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html", "name": "RHSA-2013:0533", "tags": [], "refsource": "REDHAT"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-255"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2012-0034", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2013-02-05T23:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "5.3.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2015-01-18T02:59Z"}