CVE-2017-12167

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-26 · updated 2026-06-17
Weakness: CWE-732

Description

It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are world readable allowing access to users and roles information to all the users logged in to the system.

Affected products

Red Hat JBoss EAP: before 7.0.9; 7.1.0, 7.0.0 — fixed in 7.0.9

How to fix

Upgrade to a fixed version: Red Hat JBoss EAP 7.0.9. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/100903
https://access.redhat.com/errata/RHSA-2017:3454
https://access.redhat.com/errata/RHSA-2017:3455
https://access.redhat.com/errata/RHSA-2017:3456
https://access.redhat.com/errata/RHSA-2017:3458
https://access.redhat.com/errata/RHSA-2018:0002
https://access.redhat.com/errata/RHSA-2018:0003
https://access.redhat.com/errata/RHSA-2018:0004
https://access.redhat.com/errata/RHSA-2018:0005
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12167
http://www.securityfocus.com/bid/100903
https://access.redhat.com/errata/RHSA-2017:3454

Get alerted when CVE-2017-12167 or the next vulnerability affects your stack