CVE-2012-3427

MediumCVSS 5.5

Published: 02/02/2014(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

A flaw in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI) involves incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory, allowing a local user to read sensitive files. This can lead to information disclosure, specifically exposing AWS credentials.

Risk Assessment

A local user can obtain AWS credentials and use them for unauthorized access to cloud resources.

Recommendation

Fix permissions on /var/cache/jboss-ec2-eap/ and update JBoss EAP to a patched version.

Other vulnerabilities in JBoss Enterprise Application Platform

CVE-2010-0738MediumActively exploited
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for GET and POST methods, allowing remote attackers to send requests using other methods.

Original NVD description (English source)

A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS