Cryptographic issues in JBoss Enterprise Application Platform - CVE-2013-1921
Published: September 28, 2013 / Updated: August 10, 2020
Vulnerability identifier: #VU42525
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-1921
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.
Affected software
JBoss Enterprise Application Platform
How to mitigate CVE-2013-1921
Install update from vendor's website.