CVE-2024-1102: Unprotected Transport of Credentials in Red Hat Red Hat JBoss Enterprise Application Platform 7.4.16

CVE-2024-1102 is an information exposure vulnerability in the jberet-core logging mechanism of Red Hat JBoss Enterprise Application Platform. Specifically, an exception occurring in 'dbProperties' may cause sensitive database credentials, including usernames and passwords, to be logged and potentially exposed. This vulnerability affects JBoss EAP versions 7.4.0 through 7.4.15 and 8.0.0 through 8.0.1. Red Hat has released security updates in versions 7.4.16 and 8.0.2 that fix this issue. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting a medium severity with high confidentiality impact but no integrity or availability impact.

The vulnerability allows sensitive database credentials to be exposed through logging, which could lead to unauthorized access to the database if an attacker can access the logs. The confidentiality impact is high, but there is no impact on integrity or availability. Exploitation does not require user interaction but does require low privileges. There are no known exploits in the wild at this time.

Security updates fixing this vulnerability are available and should be applied. Red Hat has released fixed versions 7.4.16 and 8.0.2 of JBoss Enterprise Application Platform that address this issue. Users should update to these versions or later. Before applying updates, ensure all previous errata are applied and back up existing installations, including applications, configurations, and databases. No additional mitigation steps are indicated by the vendor advisory.