Information Disclosure

2019-01-1508:52:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

5.1%

JSON

JBoss SX and PicketBox is vulnerable to information disclosure. The audit.log file which stores logs containing confidential information is world-readable. This allows a local user to read the log file and obtain sensitive information such as usernames and passwords.

CPENameOperatorVersion
jboss-as-cmpeq7.3.1__2.Final_redhat_3.1.ep6.el6
jboss-as-cmpeq7.3.1__2.Final_redhat_3.1.ep6.el5
jboss-as-cmpeq7.3.2__2.Final_redhat_2.1.ep6.el5
jboss-as-cmpeq7.1.2__7.Final_redhat_1.ep6.el5
jboss-as-cmpeq7.1.3__4.Final_redhat_4.ep6.el5
jboss-as-cmpeq7.3.2__2.Final_redhat_2.1.ep6.el6
jboss-as-cmpeq7.1.3__4.Final_redhat_4.ep6.el6
jboss-as-cmpeq7.2.1__5.Final_redhat_10.1.ep6.el5
jboss-as-cmpeq7.3.0__6.Final_redhat_14.1.ep6.el6
jboss-as-cmpeq7.2.0__8.Final_redhat_8.ep6.el6

Name	Operator	Version
jboss-as-cmp	eq	7.3.1__2.Final_redhat_3.1.ep6.el6
jboss-as-cmp	eq	7.3.1__2.Final_redhat_3.1.ep6.el5
jboss-as-cmp	eq	7.3.2__2.Final_redhat_2.1.ep6.el5
jboss-as-cmp	eq	7.1.2__7.Final_redhat_1.ep6.el5
jboss-as-cmp	eq	7.1.3__4.Final_redhat_4.ep6.el5
jboss-as-cmp	eq	7.3.2__2.Final_redhat_2.1.ep6.el6
jboss-as-cmp	eq	7.1.3__4.Final_redhat_4.ep6.el6
jboss-as-cmp	eq	7.2.1__5.Final_redhat_10.1.ep6.el5
jboss-as-cmp	eq	7.3.0__6.Final_redhat_14.1.ep6.el6
jboss-as-cmp	eq	7.2.0__8.Final_redhat_8.ep6.el6