Description

PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2013-1207.html

http://rhn.redhat.com/errata/RHSA-2013-1208.html

http://rhn.redhat.com/errata/RHSA-2013-1209.html

http://rhn.redhat.com/errata/RHSA-2013-1437.html

http://rhn.redhat.com/errata/RHSA-2014-0029.html

https://bugzilla.redhat.com/show_bug.cgi?id=948106

Related Vulnerabilities

CVE-2015-5298 Vulnerability in maven package org.jenkins-ci.plugins:google-login

CVE-2022-36100 Vulnerability in maven package org.xwiki.platform:xwiki-platform-tag-ui

CVE-2020-2255 Vulnerability in maven package io.jenkins.blueocean:blueocean-parent

CVE-2018-3774 Vulnerability in npm package url-parse

CVE-2021-36738 Vulnerability in maven package org.apache.portals.pluto.demo:applicant-mvcbean-cdi-jsp-portlet

Severity

Critical

Classification

CWE-310

Tags

Vendor Advisory