CVE-2012-3431

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-11-23 · updated 2026-06-16
Weakness: CWE-310

Description

The Teiid Java Database Connectivity (JDBC) socket, as used in JBoss Enterprise Data Services Platform before 5.3.0, does not encrypt login messages by default contrary to documentation and specification, which allows remote attackers to obtain login credentials via a man-in-the-middle (MITM) attack.

Affected products

RedHat Jboss Enterprise Data Services Platform: through 5.2.0; 5.1.0

References

http://rhn.redhat.com/errata/RHSA-2012-1301.html
http://www.securityfocus.com/bid/55634
https://bugzilla.redhat.com/show_bug.cgi?id=843669
https://exchange.xforce.ibmcloud.com/vulnerabilities/78803
http://rhn.redhat.com/errata/RHSA-2012-1301.html
http://www.securityfocus.com/bid/55634
https://bugzilla.redhat.com/show_bug.cgi?id=843669
https://exchange.xforce.ibmcloud.com/vulnerabilities/78803

Get alerted when CVE-2012-3431 or the next vulnerability affects your stack