CVE-2014-0058

2014-02-2615:55:08

CWE-310

[email protected]

web.nvd.nist.gov

red hat

jboss eap

security audit

plaintext logging

password exposure

nvd

cve-2014-0058

1.9 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

8.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.

Affected configurations

NVD

Node

redhatjboss_enterprise_application_platformMatch6.0.0

redhatjboss_enterprise_application_platformMatch6.0.1

redhatjboss_enterprise_application_platformMatch6.1.0

redhatjboss_enterprise_application_platformMatch6.2.0

CPENameOperatorVersion
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.0.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.0.1
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.1.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.2.0

CPE	Name	Operator	Version
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.0.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.0.1
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.1.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.2.0