Description

The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file.

Remediation

References

CVE-2012-0034

Related Vulnerabilities

WordPress Plugin Advanced Custom Fields PRO PHP Object Injection (6.0.7)

Lighttpd Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2014-2323)

WordPress Plugin Email Log Information Disclosure (1.9)

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-30537)

ownCloud Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-5866)

Severity

Low

Tags

Missing Update Known Vulnerabilities CVE-2012-0034