CVE-2016-7043

Опубликовано: 15 мая 2019

Источник: nvd

CVSS3: 5.9

CVSS3: 9.8

CVSS2: 5

EPSS Низкий

Описание

It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7043
Issue Tracking
Third Party Advisory
https://github.com/kiegroup/droolsjbpm-integration/pull/1273
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7043
Issue Tracking
Third Party Advisory
https://github.com/kiegroup/droolsjbpm-integration/pull/1273
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:kie-server:*:*:*:*:*:*:*:*

Версия до 7.21.0 (исключая)

EPSS

Процентиль: 53%

0.00298

Низкий

5.9 Medium

CVSS3

9.8 Critical

CVSS3

5 Medium

CVSS2

Дефекты

CWE-260

CWE-255

Связанные уязвимости

CVE-2016-7043

CVSS3: 5.9

redhat

больше 6 лет назад

GHSA-pjw3-c74j-m9fj

CVSS3: 9.8

github

больше 3 лет назад

Password in config file in KIE server

EPSS

Процентиль: 53%

0.00298

Низкий

5.9 Medium

CVSS3

9.8 Critical

CVSS3

5 Medium

CVSS2

Дефекты

CWE-260

CWE-255