CVE-2019-14885 Information disclosure in JBoss EAP
Attackers can read confidential security attribute values from JBoss EAP log files after a reload command, exposing sensitive system properties.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14885?
CVE-2019-14885 is a medium-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 23 Jan 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information.
Weakness: CWE-532
Which versions are affected by CVE-2019-14885?
It affects 2 products.
Linux distribution packages (9)
jboss-as-controller Red Hat:jboss_enterprise_application_platform:6::el5 | All versions | 0:7.5.22-3.Final_redhat_4.1.ep6.el5 |
jboss-as-server Red Hat:jboss_enterprise_application_platform:6::el5 | All versions | 0:7.5.22-3.Final_redhat_4.1.ep6.el5 |
jboss-as-weld Red Hat:jboss_enterprise_application_platform:6::el5 | All versions | 0:7.5.22-3.Final_redhat_4.1.ep6.el5 |
jboss-as-controller Red Hat:jboss_enterprise_application_platform:6::el6 | All versions | 0:7.5.22-3.Final_redhat_4.1.ep6.el6 |
jboss-as-server Red Hat:jboss_enterprise_application_platform:6::el6 | All versions | 0:7.5.22-3.Final_redhat_4.1.ep6.el6 |
jboss-as-weld Red Hat:jboss_enterprise_application_platform:6::el6 | All versions | 0:7.5.22-3.Final_redhat_4.1.ep6.el6 |
jboss-as-controller Red Hat:jboss_enterprise_application_platform:6::el7 | All versions | 0:7.5.22-3.Final_redhat_4.1.ep6.el7 |
jboss-as-server Red Hat:jboss_enterprise_application_platform:6::el7 | All versions | 0:7.5.22-3.Final_redhat_4.1.ep6.el7 |
jboss-as-weld Red Hat:jboss_enterprise_application_platform:6::el7 | All versions | 0:7.5.22-3.Final_redhat_4.1.ep6.el7 |
Products include Redhat Jboss Enterprise Application Platform, Redhat Single Sign-On.
How do I fix CVE-2019-14885?
Upgrade to a fixed version.
Is CVE-2019-14885 being exploited?
There is no known exploitation of CVE-2019-14885 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution
- CVE-2010-1428 Red Hat JBoss Information Disclosure
- CVE-2010-0738 Red Hat JBoss Authentication Bypass
- CVE-2016-3690 Deserialization in n/a
- CVE-2017-7504 Deserialization in JBoss
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-cxpp-v3rm-fq33, RHSA-2020:2169.