Log in Start free

Vulnerability · Published Apr 25, 2024 · Assigned by redhat

CVE-2024-1102Jberet: jberet-core logging database credentials

Medium 6.5

In plain English

A medium-severity information exposure in jberet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.8%top 43.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.jberet:jberet-core2.2.1.FinalGHSA-9wmf-xf3h-r8pr

Affected products (as reported)

VendorProductVersions
jberet 0 – before 2.2.1
Red Hat Red Hat JBoss Enterprise Application Platform 7.4.16 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Data Grid 8 see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat JBoss Data Grid 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references
Red Hat Red Hat Single Sign-On 7 see references

Weakness: CWE-523, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References