CVE-2012-0034: Low severity redhat JBoss Enterprise Application Platform vulnerability
It was found that the NonManagedConnectionFactory would log the username and password in cleartext when an exception was thrown. A local attacker could exploit this flaw by reading the password from the log file, if they had appropriate permissions to read the log file.
Other sources
The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0034?
CVE-2012-0034 is considered a moderate vulnerability due to the potential exposure of sensitive credentials.
How do I fix CVE-2012-0034?
To fix CVE-2012-0034, upgrade to Red Hat JBoss Enterprise Application Platform or JBoss Enterprise Web Platform version 5.3.0 or later.
What type of software is affected by CVE-2012-0034?
CVE-2012-0034 affects Red Hat JBoss Enterprise Application Platform versions 5.1.2 and 5.2.0 and Red Hat JBoss Enterprise Web Platform versions 5.1.2 and 5.2.0.
Can a local attacker exploit CVE-2012-0034?
Yes, a local attacker with access to the log files can exploit CVE-2012-0034 to read the username and password in cleartext.
What happens when an exception is logged in CVE-2012-0034?
When an exception occurs in CVE-2012-0034, the NonManagedConnectionFactory logs the username and password in cleartext, creating a security risk.