CVE-2016-7043 Password in config file in KIE server
Attackers with local access can read plaintext credentials from Java properties to gain unauthorized access to KIE services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7043?
CVE-2016-7043 is a medium-severity vulnerability in kie-server, published on 15 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services.
Which versions are affected by CVE-2016-7043?
2 open source packages ship an affected version, including org.kie.server:kie-server-common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.kie.server:kie-server-common Maven | All versions | 7.21.0.Final |
org.kie.server:kie-server-common Maven | All versions | 7.21.0.Final |
Products include Redhat Kie-Server.
How do I fix CVE-2016-7043?
Upgrade org.kie.server:kie-server-common to 7.21.0.Final or later.
Is CVE-2016-7043 being exploited?
There is no known exploitation of CVE-2016-7043 in the wild and no public exploit code.
Sources
Also known as GHSA-pjw3-c74j-m9fj.