CVE-2012-0034
Last modified
CVE-2012-0034 is a vulnerability of currently unknown severity. The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file.. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Jboss Enterprise Application Platform | 5.1.2 |
| Redhat | Jboss Enterprise Application Platform | 5.2.0 |
| Redhat | Jboss Enterprise Web Platform | 5.1.2 |
| Redhat | Jboss Enterprise Web Platform | 5.2.0 |
| Redhat | Jboss Enterprise Brms Platform | <= 5.3.0 |
References
- http://rhn.redhat.com/errata/RHSA-2012-0108.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0192.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0195.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0196.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0197.htmlVendor Advisory
- http://secunia.com/advisories/51984Vendor Advisory
- http://secunia.com/advisories/52054Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0108.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0192.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0195.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0196.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0197.htmlVendor Advisory
- http://secunia.com/advisories/51984Vendor Advisory
- http://secunia.com/advisories/52054Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2012-0034?
How severe is CVE-2012-0034?
How do I fix CVE-2012-0034?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-0028The robust futex implementation in the Linux kernel before 2…
- CVE-2012-0029Heap-based buffer overflow in the process_tx_desc function i…
- CVE-2012-0030Nova 2011.3 and Essex, when using the OpenStack API, allows …
- CVE-2012-0031scoreboard.c in the Apache HTTP Server 2.2.21 and earlier mi…
- CVE-2012-0032Red Hat JBoss Operations Network (JON) before 3.0.1 uses 077…
- CVE-2012-0033The CBounceDCCMod::OnPrivCTCP function in bouncedcc.cpp in t…
- CVE-2012-0035Untrusted search path vulnerability in EDE in CEDET before 1…
- CVE-2012-0036curl and libcurl 7.2x before 7.24.0 do not properly consider…
- CVE-2012-0037Redland Raptor (aka libraptor) before 2.0.7, as used by Open…6.5
- CVE-2012-0038Integer overflow in the xfs_acl_from_disk function in fs/xfs…5.5
- CVE-2012-0039GLib 2.31.8 and earlier, when the g_str_hash function is use…7.5
- CVE-2012-0040Cross-site scripting (XSS) vulnerability in modules/core/www…
Are you affected by CVE-2012-0034?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST