CVE-2013-1921: Low severity jboss enterprise application platform vulnerability
PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.
Other sources
The data file used by PicketBox Vault to store encrypted passwords contains a copy of its own admin key. The file is encrypted using only this admin key, not the corresponding JKS key. A local attacker with permission to read the vault data file could read the admin key from the file, and use it to decrypt the file and read the stored passwords stored in cleartext.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1921?
CVE-2013-1921 is considered a high severity vulnerability due to its potential to expose sensitive admin encryption keys.
How do I fix CVE-2013-1921?
To fix CVE-2013-1921, upgrade to a version of Red Hat JBoss Enterprise Application Platform that is patched and not affected by this vulnerability.
Which versions of JBoss are affected by CVE-2013-1921?
CVE-2013-1921 affects Red Hat JBoss Enterprise Application Platform versions up to 6.1.0 and certain specified earlier versions.
What is the impact of CVE-2013-1921?
The impact of CVE-2013-1921 includes unauthorized access to the admin encryption key, allowing local users to potentially compromise encrypted credentials.
Is my system at risk with CVE-2013-1921?
If you are using an affected version of Red Hat JBoss Enterprise Application Platform without the necessary updates, your system is at risk due to CVE-2013-1921.