PT-2019-7839 · Red Hat · Kie Server+1

Pavel Polischouk · Published 2019-05-15 · Updated 2023-02-12 · CVE-2016-7043

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KIE server and Business Central versions prior to 7.21.0.Final

Description A security issue has been reported where username and password are stored as plaintext Java properties. This allows any application deployed on the same server to access these properties, potentially granting access to other services.

Recommendations For versions prior to 7.21.0.Final, update to version 7.21.0.Final or later to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation. Avoid using plaintext storage for sensitive information like username and password until the issue is resolved.

Fix

Weakness Enumeration

CWE-260

CWE-255

Related Identifiers

CVE-2016-7043

GHSA-PJW3-C74J-M9FJ

Affected Products

Business Central

Kie Server

References · 5

• https://github.com/kiegroup/droolsjbpm-integration/pull/1273 · Patch
• https://osv.dev/vulnerability/GHSA-pjw3-c74j-m9fj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7043 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7043 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7043 · Note