Information Disclosure

2019-01-1509:15:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

54.2%

JSON

eap7-jboss-xnio-base is vulnerable to information disclosure attacks. The vulnerability exists as an information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information.

CPENameOperatorVersion
eap7-picketlink-bindingseq2.5.5__3.SP3_redhat_1.1.ep7.el6
eap7-picketlink-bindingseq2.5.5__2.SP2_redhat_1.1.ep7.el6
eap7-picketlink-bindingseq2.5.5__3.SP3_redhat_1.1.ep7.el7
eap7-picketlink-bindingseq2.5.5__1.SP1_redhat_2.2.ep7.el6
eap7-picketlink-bindingseq2.5.5__2.SP2_redhat_1.1.ep7.el7
eap7-picketlink-bindingseq2.5.5__1.SP1_redhat_2.2.ep7.el7
eap7-picketlink-federationeq2.5.5__1.SP1_redhat_1.1.ep7.el7
eap7-picketlink-federationeq2.5.5__3.SP3_redhat_1.1.ep7.el6
eap7-picketlink-federationeq2.5.5__2.SP2_redhat_1.1.ep7.el6
eap7-picketlink-federationeq2.5.5__1.SP1_redhat_1.1.ep7.el6

Name	Operator	Version
eap7-picketlink-bindings	eq	2.5.5__3.SP3_redhat_1.1.ep7.el6
eap7-picketlink-bindings	eq	2.5.5__2.SP2_redhat_1.1.ep7.el6
eap7-picketlink-bindings	eq	2.5.5__3.SP3_redhat_1.1.ep7.el7
eap7-picketlink-bindings	eq	2.5.5__1.SP1_redhat_2.2.ep7.el6
eap7-picketlink-bindings	eq	2.5.5__2.SP2_redhat_1.1.ep7.el7
eap7-picketlink-bindings	eq	2.5.5__1.SP1_redhat_2.2.ep7.el7
eap7-picketlink-federation	eq	2.5.5__1.SP1_redhat_1.1.ep7.el7
eap7-picketlink-federation	eq	2.5.5__3.SP3_redhat_1.1.ep7.el6
eap7-picketlink-federation	eq	2.5.5__2.SP2_redhat_1.1.ep7.el6
eap7-picketlink-federation	eq	2.5.5__1.SP1_redhat_1.1.ep7.el6