CVE-2013-0218

The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file.
Severity
UNKNOWN
AV:L/AC:L/Au:N/C:P/I:N/A:N
Atk. Vector
LOCAL
Atk. Complexity
LOW
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
VendorProductVersion
redhatjboss_enterprise_application_platform
5.1.2
redhatjboss_enterprise_application_platform
5.2.0
redhatjboss_enterprise_web_platform
5.1.2
redhatjboss_enterprise_web_platform
5.2.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
jbossas4
quantal
not-affected
precise
not-affected
oneiric
not-affected
lucid
not-affected
hardy
not-affected
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2013-0206.html
http://rhn.redhat.com/errata/RHSA-2013-0207.html
http://rhn.redhat.com/errata/RHSA-2013-0833.html
http://secunia.com/advisories/52041
http://www.osvdb.org/89698
http://www.securityfocus.com/bid/57652
https://bugzilla.redhat.com/show_bug.cgi?id=903073
https://exchange.xforce.ibmcloud.com/vulnerabilities/81725
http://rhn.redhat.com/errata/RHSA-2013-0206.html
http://rhn.redhat.com/errata/RHSA-2013-0207.html
http://rhn.redhat.com/errata/RHSA-2013-0833.html
http://secunia.com/advisories/52041
http://www.osvdb.org/89698
http://www.securityfocus.com/bid/57652
https://bugzilla.redhat.com/show_bug.cgi?id=903073
https://exchange.xforce.ibmcloud.com/vulnerabilities/81725