CVE-2014-0085 Exposure of Sensitive Information to an Unauthorized Actor in JBoss Fuse

LowCVSS 2.1 EPSS 0.38%

Published: 2014-04-17 17:00
Updated: 2026-06-17 03:02
Exploit status: No public exploit known

Description

JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.

Affected products

Product	Affected versions	Fixed in
org.jboss.fuse/jboss-fuse(Maven)	< 6.1.0	6.1.0
redhat jboss a-mq	= 6.0.0	No fix listed
redhat jboss fuse	= 6.0.0	No fix listed

References

nvd.nist.gov third-party-advisory vendor-advisory
bugzilla.redhat.com issue-tracking third-party-advisory
github.com

CVSS v2.0

2.1 Low

AV:L/AC:L/Au:N/C:P/I:N/A:N

Access Vector: Local
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: None
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.38% (percentile 32.7)
CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-255

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.