CVE-2015-1849: Infoleak
First published: Thu Apr 02 2015(Updated: )
AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| JBoss Enterprise Application Platform | <=6.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1199641
- https://github.com/wildfly-security/jboss-negotiation/pull/21
- https://bugzilla.redhat.com/show_bug.cgi?id=1208580
- https://bugzilla.redhat.com/show_bug.cgi?id=1199641
- https://github.com/wildfly-security/jboss-negotiation/commit/0dc9d191b6eb1d13b8f0189c5b02ba6576f4722e
Frequently Asked Questions
What is the severity of CVE-2015-1849?
CVE-2015-1849 is classified as a moderate vulnerability due to its potential to leak sensitive information.
How do I fix CVE-2015-1849?
To mitigate CVE-2015-1849, upgrade to Red Hat JBoss Enterprise Application Platform version 6.4.1 or later.
What software is affected by CVE-2015-1849?
CVE-2015-1849 affects Red Hat JBoss Enterprise Application Platform versions prior to 6.4.1.
What kind of information can be leaked by CVE-2015-1849?
CVE-2015-1849 can lead to the exposure of LDAP bind credential passwords when TRACE logging is enabled.
Is TRACE logging recommended in Red Hat JBoss EAP affected by CVE-2015-1849?
No, enabling TRACE logging in Red Hat JBoss EAP can expose sensitive information and is not recommended.
- collector/redhat-bugzilla
- alias/CVE-2015-1849
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/author
- agent/references
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/jboss enterprise application platform
- version/jboss enterprise application platform/6.4.0