CVE-2012-3431

The Teiid Java Database Connectivity (JDBC) socket, as used in JBoss Enterprise Data Services Platform before 5.3.0, does not encrypt login messages by default contrary to documentation and specification, which allows remote attackers to obtain login credentials via a man-in-the-middle (MITM) attack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 56%
VendorProductVersion
redhatjboss_enterprise_data_services_platform
𝑥
≤ 5.2.0
redhatjboss_enterprise_data_services_platform
5.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2012-1301.html
http://www.securityfocus.com/bid/55634
https://bugzilla.redhat.com/show_bug.cgi?id=843669
https://exchange.xforce.ibmcloud.com/vulnerabilities/78803
http://rhn.redhat.com/errata/RHSA-2012-1301.html
http://www.securityfocus.com/bid/55634
https://bugzilla.redhat.com/show_bug.cgi?id=843669
https://exchange.xforce.ibmcloud.com/vulnerabilities/78803