{"id":"CVE-2012-3427","aliases":["EUVD-2012-3395","GHSA-mhvm-wr2g-3xfq","RHSA-2012:1376"],"status":"published","title":"Jboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions","description":"A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00338,"percentile":0.27404,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-276"],"published":"2014-02-02T20:00:00Z","modified":"2026-10-30T21:32:50Z","fixes":[{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jboss-ec2-eap","fixed_in":["0:5.1.2-8.11.ep5.el6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jboss-ec2-eap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.2-8.11.ep5.el6"}]}]}],"products":[{"vendor":"red hat","product":"red hat jboss enterprise application platform 5 for rhel 6"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"redhat","product":"jboss_enterprise_application_platform"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2012-1376.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/51016","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/86409","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/55945","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2012:1376","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3427","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79398","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3427","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mhvm-wr2g-3xfq"},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=843335","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1376.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3427","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-3427","title":"Jboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions","description":"A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials.","status":"published","published":"2014-02-02T20:00:00Z","modified":"2026-10-30T18:03:36.476Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:34:50.615647Z"}],"euvd":[{"id":"EUVD-2012-3395","description":"A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials.","status":"published","published":"2014-02-02T20:00:00Z","modified":"2026-10-30T18:03:36Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:03.071815Z"}],"ghsa":[{"id":"GHSA-mhvm-wr2g-3xfq","title":"EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application Platform (EAP) 5.1.2 uses 755...","description":"EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application Platform (EAP) 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services (AWS) credentials by reading files in the directory.","status":"published","published":"2022-05-17T01:44:03Z","modified":"2026-10-30T21:32:50Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:14:53.220001Z"}],"nvd":[{"id":"CVE-2012-3427","description":"A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials.","status":"published","published":"2014-02-02T20:55:04.883Z","modified":"2026-10-30T19:17:25.587Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-276","CWE-264"],"updated_at":"2026-11-02T14:02:17.375282Z"}],"osv":[{"id":"RHSA-2012:1376","title":"Red Hat Security Advisory: jboss-ec2-eap security update","status":"published","published":"2024-09-15T20:08:50Z","modified":"2025-11-22T10:39:42Z","updated_at":"2026-11-02T15:53:01.495018Z"}]}}