CVE-2013-1921

PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.

CVSS v2.0 1.9 LOW

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2013-1207.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1208.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1209.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1437.html
http://rhn.redhat.com/errata/RHSA-2014-0029.html
https://bugzilla.redhat.com/show_bug.cgi?id=948106

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:jboss_enterprise_application_platform::::::::
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.1:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.1:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.1:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.2:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.1:::::::*

History

No history.

Information

Published : 2013-09-28 19:55

Updated : 2014-03-08 05:05

NVD link : CVE-2013-1921

Mitre link : CVE-2013-1921

CVE.ORG link : CVE-2013-1921

JSON object : View

Products Affected

redhat

jboss_enterprise_application_platform

CWE

CWE-310

Cryptographic Issues

{"id": "CVE-2013-1921", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-09-28T19:55:02.883", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2013-1207.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1208.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1209.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1437.html", "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2014-0029.html", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=948106", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file."}, {"lang": "es", "value": "PicketBox, utilizado en Red Hat JBoss Enterprise Application Platform anteriores a 6.1.1, permite a un usuario local obtener la clave de cifrado de administrador leyendo el archivo de datos Vault."}], "lastModified": "2014-03-08T05:05:51.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00CE1A18-B944-416D-BF36-8F94C0A3C00F", "versionEndIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9164BEAF-B1D5-4E65-A6CE-F985799467CB"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E82B2AD8-967D-4ABE-982B-87B9DE73F8D6"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5D7F1AD-4BD3-4C37-B6B5-B287464B2EEB"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76D8FCD1-55D5-4187-87DD-39904EDE2EF8"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "972C5C87-E982-44A5-866D-FDEACB5203B8"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C13890AE-5FDE-4698-8A2E-1B2FA0A313AF"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A785F07-9B76-4153-B676-29C9682B2F73"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46849C8D-36E9-4E97-BB49-E04F4EB199E6"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99D29C15-4423-4EB1-BF7F-7081B4EE6416"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E66331CF-15C6-424A-90F8-F8F4FD3EC1E5"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B142ACCC-F7A9-4A3B-BE60-0D6691D5058D"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F94D102-60EA-4C47-9A39-DAE4704044DD"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}