CVE-2015-1849

medium

Description

AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.

References

Advisories
More

https://github.com/wildfly-security/jboss-negotiation/pull/21

https://github.com/wildfly-security/jboss-negotiation/commit/0dc9d191b6eb1d13b8f0189c5b02ba6576f4722e

https://bugzilla.redhat.com/show_bug.cgi?id=1208580

https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-1960

https://bugzilla.redhat.com/show_bug.cgi?id=1199641

Details

Source: Mitre, NVD

Published: 2017-09-19

Updated: 2026-05-13

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N