GitHub Advisoryadvisory · Maven

GHSA-pjw3-c74j-m9fj Password in config file in KIE server

CRITICAL Published 2022-05-24 Modified 2023-02-14 Official page ↗
Aliases
CVE-2016-7043
Ecosystem
Maven
Packages
org.kie.server:kie-server-common
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-260
Reviewed
2023-02-14

Affected packages

• Maven org.kie.server:kie-server-common: < 7.21.0.Final → fixed in 7.21.0.Final

Description

It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services.

Related

Alias · CVE (1)

  • CVE-2016-7043 It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java… vulnerability

Weakness · CWE (1)

  • CWE-260 Password in Configuration File weakness

References