Description
The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | jboss-as-web | 7.3.1-4.Final_redhat_4.1.ep6.el5 | RHSA-2014:0204 |
Advisories 1
- RHSA-2014:0204 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2014:0204 vendor-advisory
- RHSA-2015:0034 vendor-advisory
- RHSA-2014:0205 vendor-advisory
- 65762 vdb-entry