Vulnerability Description
The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Jboss Enterprise Application Platform | 5.1.2 |
| Redhat | Jboss Enterprise Web Platform | 5.1.2 |
| Redhat | Jboss Enterprise Brms Platform | <= 5.3.0 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2012-0108.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1072.html
- http://rhn.redhat.com/errata/RHSA-2013-0191.html
- http://rhn.redhat.com/errata/RHSA-2013-0192.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0193.html
- http://rhn.redhat.com/errata/RHSA-2013-0195.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0196.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0197.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0221.html
- http://rhn.redhat.com/errata/RHSA-2013-0533.html
- http://secunia.com/advisories/51984Vendor Advisory
- http://secunia.com/advisories/52054Vendor Advisory
- http://www.osvdb.org/78259
- http://www.securityfocus.com/bid/51392
- https://bugzilla.redhat.com/show_bug.cgi?id=772835
FAQ
What is CVE-2012-0034?
CVE-2012-0034 is a vulnerability with a CVSS score of 2.1 (LOW). The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cle...
How severe is CVE-2012-0034?
CVE-2012-0034 has been rated LOW with a CVSS base score of 2.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-0034?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Web Platform, Redhat Jboss Enterprise Brms Platform.