Permissions, Privileges, and Access Controls in JBoss Enterprise Application Platform - CVE-2012-3427

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU42083

Permissions, Privileges, and Access Controls in JBoss Enterprise Application Platform - CVE-2012-3427

Published: February 2, 2014 / Updated: August 10, 2020


Vulnerability identifier: #VU42083
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2012-3427
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Red Hat Inc.
Affected software:
JBoss Enterprise Application Platform

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application Platform (EAP) 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services (AWS) credentials by reading files in the directory.


How to mitigate CVE-2012-3427

Install update from vendor's website.

Sources