GitHub Advisoryadvisory · Maven

GHSA-jw3v-5ch2-wfmm Wildfly logs plaintext passwords

MEDIUM Published 2022-02-15 Modified 2023-07-13 Official page ↗
Aliases
CVE-2020-25640
Ecosystem
Maven
Packages
org.wildfly:wildfly-parent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-209, CWE-532
Reviewed
2023-07-13

Affected packages

• Maven org.wildfly:wildfly-parent: < 21.0.0.Final → fixed in 21.0.0.Final

Description

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

Related

Alias · CVE (1)

  • CVE-2020-25640 A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection… vulnerability

Weakness · CWE (2)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References