CVEvulnerability

CVE-2017-12167

5.5 MEDIUM Published 2018-07-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-07-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.5 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0 ([email protected])
5.5 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-732

Description

It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are world readable allowing access to users and roles information to all the users logged in to the system.

Affected configurations

• redhat jboss enterprise application platform (< 7.0.9) • redhat jboss enterprise application platform 7.1.0 • redhat jboss enterprise application platform 7.0.0

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References