CVEvulnerability
CVE-2012-3431
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-11-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-310
Description
The Teiid Java Database Connectivity (JDBC) socket, as used in JBoss Enterprise Data Services Platform before 5.3.0, does not encrypt login messages by default contrary to documentation and specification, which allows remote attackers to obtain login credentials via a man-in-the-middle (MITM) attack.
Affected configurations
• redhat jboss enterprise data services platform (<= 5.2.0)
• redhat jboss enterprise data services platform 5.1.0
Related
Weakness · not in database (1)
References
- http://rhn.redhat.com/errata/RHSA-2012-1301.html Vendor Advisory
- http://www.securityfocus.com/bid/55634 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=843669 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78803 exchange.xforce.ibmcloud.com
- http://rhn.redhat.com/errata/RHSA-2012-1301.html Vendor Advisory
- http://www.securityfocus.com/bid/55634 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=843669 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78803 exchange.xforce.ibmcloud.com