PT-2013-2163 · Red Hat · Jboss Enterprise Web Platform+1

Publicado 2013-02-05 · Atualizado 2017-08-29 · CVE-2013-0218

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) versions 5.1.2 through 5.2.0

Description The issue concerns the GUI installer in JBoss EAP and EWP, which uses world-readable permissions for the auto-install XML file. This allows local users to read the file and obtain sensitive information, including the administrator password and another password.

Recommendations For versions 5.1.2 through 5.2.0, consider changing the permissions of the auto-install XML file to prevent unauthorized access until a fix is available. As a temporary workaround, restrict local access to the system to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-0218

Produtos afetados

Red Hat Jboss Enterprise Application Platform

Jboss Enterprise Web Platform

Referências · 10

• http://rhn.redhat.com/errata/RHSA-2013-0206.html · Aviso do Fabricante
• http://securityfocus.com/bid/57652 · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0833.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-0218 · Nota de Segurança
• http://secunia.com/advisories/52041 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-0207.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81725 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0218 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=903073 · Nota
• http://osvdb.org/89698 · Nota