{"id":"CVE-2014-0058","aliases":["EUVD-2014-0151","GHSA-42c9-mw7r-66f3","RHSA-2014:0204"],"status":"published","title":"The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x...","description":"The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.","severity":{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00346,"percentile":0.28453,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-02-26T15:00:00Z","modified":"2026-08-05T10:02:25Z","fixes":[{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-web","fixed_in":["0:7.3.1-4.Final_redhat_4.1.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-web","fixed_in":["0:7.3.1-4.Final_redhat_4.1.ep6.el6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_4.1.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_4.1.ep6.el6"}]}]}],"products":[{"vendor":"redhat","product":"jboss_enterprise_application_platform"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-0204.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0034.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0205.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/65762","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0058","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-42c9-mw7r-66f3"},{"url":"https://access.redhat.com/errata/RHSA-2014:0204","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1063641","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0204.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0058","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0058","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-0058","description":"The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.","status":"published","published":"2014-02-26T15:00:00Z","modified":"2024-08-06T09:05:38.272Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0151","description":"The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.","status":"published","published":"2014-02-26T15:00:00Z","modified":"2024-08-06T09:05:38Z","updated_at":"2026-11-03T01:57:22.992Z"}],"ghsa":[{"id":"GHSA-42c9-mw7r-66f3","title":"The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x...","description":"The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.","status":"published","published":"2022-05-17T03:07:05Z","modified":"2023-01-27T05:06:59Z","updated_at":"2026-11-02T14:43:01.786793Z"}],"nvd":[{"id":"CVE-2014-0058","description":"The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.","status":"published","published":"2014-02-26T15:55:08.953Z","modified":"2026-06-17T00:02:10.55Z","cvss":[{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"RHSA-2014:0204","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update","status":"published","published":"2024-09-15T21:25:02Z","modified":"2026-08-05T10:02:25Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}