Description
The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file.
References
- RHSA-2013:0206 vendor-advisory
- 89698 vdb-entry
- 52041 third-party-advisory
- RHSA-2013:0833 vendor-advisory
- RHSA-2013:0207 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=903073
- jboss-eap-info-disc(81725) vdb-entry
- 57652 vdb-entry