5.9med
CVE-2016-7043
Password in config file in KIE server
Also known as GHSA-pjw3-c74j-m9fj
Published 7 y ago · modified 4 mo ago · JSON
CVSS
5.9
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 75%
Public exploits
0
none known
Summary
It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services.
Exploit prediction (EPSS)
1.53% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.kie.server:kie-server-common | <7.21.0.Final | 7.21.0.Final |
Affected products
- KIE kie-server
Classification
References
- bugzilla.redhat.com /show_bug.cgi?id=CVE-2016-7043 · x_refsource_CONFIRM, x_transferred
- github.com /kiegroup/droolsjbpm-integration/pull/1273 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-7043 · advisory
Sources
- CVE List: CVE-2016-7043
- GitHub Advisory: GHSA-pjw3-c74j-m9fj
- NVD: CVE-2016-7043
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.