Description
The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file.
Remediation
References
Related Vulnerabilities
Atlassian Jira Missing Authentication for Critical Function Vulnerability (CVE-2019-8449)
PostgreSQL CVE-2022-41862 Vulnerability (CVE-2022-41862)
WordPress Plugin OAuth Single Sign On-SSO (OAuth Client) Security Bypass (6.22.5)
WordPress Plugin Events Widgets For Elementor And The Events Calendar Security Bypass (1.4.3)