CVE-2012-3427
Full vulnerability record from the local CVENow database.
Description
A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2014-02-02 20:55:04.883000
Last modified
2026-10-30 19:17:25.587000
View original CVE JSON
{
"id": "CVE-2012-3427",
"sourceIdentifier": "[email protected]",
"published": "2014-02-02T20:55:04.883",
"lastModified": "2026-10-30T19:17:25.587",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials."
},
{
"lang": "es",
"value": "EC2 Amazon Machine Image (AMI) en JBoss Enterprise Application Platform (EAP) 5.1.2 utiliza permisos 755 para /var/cache/jboss-ec2-eap/, lo cual permite a usuarios locales leer información sensible como credenciales de Amazon Web Services (AWS) leyendo archivos en el directorio."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 6",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "jboss-ec2-eap",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:5::el6"
],
"versions": [
{
"version": "0:5.1.2-8.11.ep5.el6",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "org.jboss.eap-jboss-eap-parent",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "org.jboss.eap-jboss-eap-parent",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "org.jboss.eap-jboss-eap-parent",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"baseScore": 2.1,
"accessVector": "LOCAL",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"baseSeverity": "LOW",
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-276"
}
]
},
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8A785F07-9B76-4153-B676-29C9682B2F73"
}
]
}
]
}
],
"references": [
{
"url": "http://rhn.redhat.com/errata/RHSA-2012-1376.html",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "http://secunia.com/advisories/51016",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "http://www.osvdb.org/86409",
"source": "[email protected]"
},
{
"url": "http://www.securityfocus.com/bid/55945",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2012:1376",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2012-3427",
"source": "[email protected]"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79398",
"source": "[email protected]"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2012-1376.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "http://secunia.com/advisories/51016",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "http://www.osvdb.org/86409",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/55945",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79398",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}