CVE-2015-1849: Infoleak
AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
Other sources
It was reported that jboss-negotiation-extras logs LDAP bind credentials when TRACE logging is enabled:
https://bugzilla.redhat.com/showbug.cgi?id=1199641
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1849?
CVE-2015-1849 is classified as a moderate vulnerability due to its potential to leak sensitive information.
How do I fix CVE-2015-1849?
To mitigate CVE-2015-1849, upgrade to Red Hat JBoss Enterprise Application Platform version 6.4.1 or later.
What software is affected by CVE-2015-1849?
CVE-2015-1849 affects Red Hat JBoss Enterprise Application Platform versions prior to 6.4.1.
What kind of information can be leaked by CVE-2015-1849?
CVE-2015-1849 can lead to the exposure of LDAP bind credential passwords when TRACE logging is enabled.
Is TRACE logging recommended in Red Hat JBoss EAP affected by CVE-2015-1849?
No, enabling TRACE logging in Red Hat JBoss EAP can expose sensitive information and is not recommended.