PT-2013-1483 · Red Hat · Brms Platform+2

David Jorm

·

Publicado

2013-02-05

·

Atualizado

2015-01-18

·

CVE-2012-0034

CVSS v2.0

2.1

Baixa

VetorAV:L/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform (EAP) versions 5.1.2 through 5.2.0 Web Platform (EWP) versions 5.1.2 through 5.2.0 BRMS Platform versions prior to 5.3.1
Description The issue allows local users to obtain sensitive information, specifically usernames and passwords, by reading the log file when an exception is thrown. This occurs because the NonManagedConnectionFactory logs the username and password in cleartext.
Recommendations For JBoss Enterprise Application Platform (EAP) versions 5.1.2 through 5.2.0, consider updating to a version that does not log sensitive information in cleartext. For Web Platform (EWP) versions 5.1.2 through 5.2.0, consider updating to a version that does not log sensitive information in cleartext. For BRMS Platform versions prior to 5.3.1, update to version 5.3.1 or later to resolve the issue.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2012-0034
RHSA-2013:0191
RHSA-2013:0192
RHSA-2013:0193
RHSA-2013:0195
RHSA-2013:0196
RHSA-2013:0197

Produtos afetados

Brms Platform
Red Hat Jboss Enterprise Application Platform
Web Platform