CVE-2023-4066 | THREATINT

Description

A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.

Reserved 2023-08-01 | Published 2023-09-27 | Updated 2024-11-22 | Assigner redhat

MEDIUM: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

Cleartext Storage in a File or on Disk

Product status

Default status

affected

7.11.1-9 before *

unaffected

Default status

affected

7.11.1-12 before *

unaffected

Default status

affected

Timeline

2023-07-21:	Reported to Red Hat.
2023-08-23:	Made public.

References

access.redhat.com/errata/RHSA-2023:4720 (RHSA-2023:4720) vendor-advisory

access.redhat.com/security/cve/CVE-2023-4066 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2224677 (RHBZ#2224677) issue-tracking

cve.org (CVE-2023-4066)

nvd.nist.gov (CVE-2023-4066)

Download JSON