PT-2014-3455 · Red Hat · Red Hat Jboss Enterprise Application Platform

Published 2014-02-26 · Updated 2017-01-07 · CVE-2014-0058

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform (EAP) versions 6.x before 6.2.1

Description The security audit functionality logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.

Recommendations For versions 6.x before 6.2.1, update to version 6.2.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-0058

RHSA-2014:0204

Affected Products

Red Hat Jboss Enterprise Application Platform

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-0058 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0204.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0034.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0205.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0058 · Note
• http://securityfocus.com/bid/65762 · Note