What is GHSA-pjw3-c74j-m9fj?

GHSA-pjw3-c74j-m9fj is a security advisory published by GitHub Security Advisories with Critical severity. Password in config file in KIE server

Which CVE IDs does GHSA-pjw3-c74j-m9fj cover?

GHSA-pjw3-c74j-m9fj covers the following CVE IDs: CVE-2016-7043. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pjw3-c74j-m9fj?

GHSA-pjw3-c74j-m9fj has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-pjw3-c74j-m9fj?

GHSA-pjw3-c74j-m9fj affects 1 product, including: maven/org.kie.server:kie-server-common:\u003c 7.21.0.Final.

GHSA-pjw3-c74j-m9fjCriticalCVSS 9.8

Password in config file in KIE server

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

February 14, 2023

🔗 CVE IDs covered (1)

CVE-2016-7043 →

📋 Description

It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services.

🎯 Affected products1

maven/org.kie.server:kie-server-common:< 7.21.0.Final

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2016-7043
https://github.com/kiegroup/droolsjbpm-integration/pull/1273
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7043
https://github.com/advisories/GHSA-pjw3-c74j-m9fj