Bug 476080 - (CVE-2008-5083) CVE-2008-5083 JON unauthorized access private property
CVE-2008-5083 JON unauthorized access private property
Status: CLOSED DUPLICATE of bug 536105
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
source=jboss,public=20081216,reported...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-12-11 15:23 EST by Marc Schoenefeld
Modified: 2010-12-27 09:05 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-12-27 09:05:45 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Comment 1 Marc Schoenefeld 2010-12-27 09:05:45 EST
This is a duplicate of RHQ-491: 

If the user knew the name of secured property such as 'principal' or 'credentials', they could get security information about the resources managed by JBoss ON.  The fix to this was to filter out any results that deal with PASSWORD types of properties.

The issue affected JON 2.1.x and was fixed with JON 2.1.2 SP1.

*** This bug has been marked as a duplicate of bug 536105 ***

Note You need to log in before you can comment on or make changes to this bug.