CVE-2019-14885

Published: Jan 23, 2020Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information.

Affected (3)

Products: Redhat: Jboss Enterprise Application Platform, Single Sign On

2 products

Jboss Enterprise Application Platform

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Before 7.2.6
Redhat Jboss Enterprise Application Platform	Version 7.2.6
Redhat Single Sign On	Version 7.0

Related CWEs

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (2)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14885

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14885

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.