CVE-2009-5066
JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing
Severity Score
2.1
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.
twiddle.sh en JBoss AS v5.0 y PEA v5.0 y versiones anteriores acepta credenciales como argumentos de lĂnea de comandos, lo que permite a usuarios locales leer las credenciales al listar el proceso y sus argumentos.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2011-04-05 CVE Reserved
- 2012-08-13 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-255: Credentials Management Errors
CAPEC
References (18)
URL | Tag | Source |
---|---|---|
http://objectopia.com/2009/10/01/securing-jmx-invoker-layer-in-jboss | Url Repurposed | |
http://secunia.com/advisories/51984 | Third Party Advisory | |
http://secunia.com/advisories/52054 | Third Party Advisory | |
http://www.openwall.com/lists/oss-security/2012/07/20/1 | Mailing List | |
http://www.openwall.com/lists/oss-security/2012/07/23/2 | Mailing List | |
https://issues.jboss.org/browse/JBPAPP-3391?_sscc=t | X_refsource_confirm |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://rhn.redhat.com/errata/RHSA-2013-0191.html | 2024-02-14 | |
http://rhn.redhat.com/errata/RHSA-2013-0192.html | 2024-02-14 | |
http://rhn.redhat.com/errata/RHSA-2013-0193.html | 2024-02-14 | |
http://rhn.redhat.com/errata/RHSA-2013-0194.html | 2024-02-14 | |
http://rhn.redhat.com/errata/RHSA-2013-0195.html | 2024-02-14 | |
http://rhn.redhat.com/errata/RHSA-2013-0196.html | 2024-02-14 | |
http://rhn.redhat.com/errata/RHSA-2013-0197.html | 2024-02-14 | |
http://rhn.redhat.com/errata/RHSA-2013-0198.html | 2024-02-14 | |
http://rhn.redhat.com/errata/RHSA-2013-0221.html | 2024-02-14 | |
http://rhn.redhat.com/errata/RHSA-2013-0533.html | 2024-02-14 | |
https://access.redhat.com/security/cve/CVE-2009-5066 | 2013-02-20 | |
https://bugzilla.redhat.com/show_bug.cgi?id=842477 | 2013-02-20 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Redhat Search vendor "Redhat" | Jboss Community Application Server Search vendor "Redhat" for product "Jboss Community Application Server" | 5.0.0 Search vendor "Redhat" for product "Jboss Community Application Server" and version "5.0.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 5.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "5.0.0" | - |
Affected
|