CVE-2014-0085 — LOW (2.1) — White Hats Nepal

Vulnerability Description

JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.

CVSS Score

2.1

LOW

AV:L/AC:L/Au:N/C:P/I:N/A:N

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Jboss A-Mq	6.0.0
Redhat	Jboss Fuse	6.0.0

Related Weaknesses (CWE)

CWE-255

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085Issue TrackingThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085Issue TrackingThird Party Advisory

FAQ

What is CVE-2014-0085?

CVE-2014-0085 is a vulnerability with a CVSS score of 2.1 (LOW). JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been u...

How severe is CVE-2014-0085?

CVE-2014-0085 has been rated LOW with a CVSS base score of 2.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-0085?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Jboss A-Mq, Redhat Jboss Fuse.