CVE-2015-1849
published 2017-09-19CVE-2015-1849: AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors…
PriorityP430medium5.9CVSS 3.0
AVNACHPRNUINSUCHINAN
EPSS
1.72%
74.9th percentile
AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | jboss_enterprise_application_platform | <= 6.4.0 | — |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
EAP: LDAP bind password is being logged with TRACE log level
vendor_redhat·2015-03-23·CVSS 5.9
CVE-2015-1849 [MEDIUM] EAP: LDAP bind password is being logged with TRACE log level
EAP: LDAP bind password is being logged with TRACE log level
AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
Package: jboss-negotiation-extras (Red Hat JBoss Data Grid 6) - Affected
Package: jboss-negotiation-extras (Red Hat JBoss Data Virtualization 6) - Affected
Package: jboss-negotiation-extras (Red Hat JBoss Fuse Service Works 6) - Affected
Package: jboss-negotiation-extras (Red Hat JBoss Operations Network 3) - Affected
Package: jboss-negotiation-extras (Red Hat JBoss Portal 6) - Affected
GHSA
GHSA-6hhx-86qx-9ffc: AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6
ghsa_unreviewed·2022-05-17
CVE-2015-1849 [MEDIUM] CWE-200 GHSA-6hhx-86qx-9ffc: AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6
AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
No detection rules found.
No public exploits indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1199641https://bugzilla.redhat.com/show_bug.cgi?id=1208580https://github.com/wildfly-security/jboss-negotiation/commit/0dc9d191b6eb1d13b8f0189c5b02ba6576f4722ehttps://github.com/wildfly-security/jboss-negotiation/pull/21https://bugzilla.redhat.com/show_bug.cgi?id=1199641https://bugzilla.redhat.com/show_bug.cgi?id=1208580https://github.com/wildfly-security/jboss-negotiation/commit/0dc9d191b6eb1d13b8f0189c5b02ba6576f4722ehttps://github.com/wildfly-security/jboss-negotiation/pull/21
2017-09-19
Published