CVE-2014-0059: Infoleak
It was identified that security auditing provided by JBossSX/PicketBox logged sensitive information into a world readable audit.log file. This information could be used by a local attacker to gain otherwise protected information about user sessions etc.
Other sources
JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0059?
CVE-2014-0059 has been assigned a medium severity rating due to the exposure of sensitive information in accessible log files.
How do I fix CVE-2014-0059?
Fix CVE-2014-0059 by updating to a patched version of JBoss Enterprise Application Platform that addresses the logging vulnerabilities.
Who is affected by CVE-2014-0059?
CVE-2014-0059 affects users of JBoss Enterprise Application Platform versions up to and including 6.2.2.
What types of information are exposed by CVE-2014-0059?
CVE-2014-0059 exposes sensitive user session information due to insecure auditing practices in log files.
Can local attackers exploit CVE-2014-0059?
Yes, local attackers can exploit CVE-2014-0059 to gain access to sensitive information logged in world-readable files.