Vulnerability Details : CVE-2021-3425
A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions shipped in Red Hat AMQ 7 are vulnerable.
Products affected by CVE-2021-3425
- cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-3425
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 14 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-3425
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:P/I:N/A:N |
3.9
|
2.9
|
NIST | |
|
4.4
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
0.8
|
3.6
|
NIST |
CWE ids for CVE-2021-3425
-
The product writes sensitive information to a log file.Assigned by: secalert@redhat.com (Primary)
References for CVE-2021-3425
-
https://bugzilla.redhat.com/show_bug.cgi?id=1936629
1936629 – (CVE-2021-3425) CVE-2021-3425 Red Hat AMQ Broker: discloses JDBC username and password in the application log fileIssue Tracking;Vendor Advisory
Jump to