CVE-2012-3427

Jboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions

5.5 MediumFix available

A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.34%Down 0.6 points since Feb 4, 2022

What each source reports

CVE List Score used 5.5

Jboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions

Record: CVE-2012-3427
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-276
Updated: 2026-11-02

EUVDEUVD-2012-3395 5.5

Record: EUVD-2012-3395
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mhvm-wr2g-3xfq 5.5

EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application Platform (EAP) 5.1.2 uses 755...

EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application Platform (EAP) 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services (AWS) credentials by reading files in the directory.

Record: GHSA-mhvm-wr2g-3xfq
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-276
Updated: 2026-11-02

NVD 5.5

Record: CVE-2012-3427
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-276, CWE-264
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`jboss-ec2-eap` Red Hat:jboss_enterprise_application_platform:5::el6	before 0:5.1.2-8.11.ep5.el6	0:5.1.2-8.11.ep5.el6

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-3427 is a medium vulnerability (CVSS 5.5) in Redhat Jboss Enterprise Application Platform, published February 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in jboss-ec2-eap 0:5.1.2-8.11.ep5.el6.

References

Show 7 moreShow less