CVE-2009-3554: Infoleak
From https://jira.jboss.org/jira/browse/JBPAPP-2872
Twiddle logs all command line arguments, including the JMX password to twiddle.log. This log is publicly readable and is created in the current directory.
Other sources
Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3554?
CVE-2009-3554 is classified as a medium severity vulnerability due to exposure of sensitive information.
How do I fix CVE-2009-3554?
To fix CVE-2009-3554, ensure that logs do not capture sensitive information such as passwords, and apply patches from Red Hat.
What systems are affected by CVE-2009-3554?
CVE-2009-3554 affects specific versions of Red Hat JBoss Enterprise Application Platform, particularly versions 4.2.x.
What is the impact of CVE-2009-3554?
The impact of CVE-2009-3554 is that sensitive data, including JMX passwords, can be exposed through publicly readable log files.
Is there a workaround for CVE-2009-3554?
A possible workaround for CVE-2009-3554 is to restrict access to the directory where twiddle.log is created.