CVE-2017-12167

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are world readable allowing access to users and roles information to all the users logged in to the system.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732 CWE-200

Affected software

Vendor	Product	Versions
Red Hat	EAP-7	7.0.9

References

http://www.securityfocus.com/bid/100903Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3454Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3455Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3456Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3458Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0002Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0003Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0004Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0005Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12167Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/100903Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3454Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3455Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3456Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3458Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0002Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0003Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0004Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0005Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12167Issue Tracking, Vendor Advisory

Timeline

Published: Jul 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-121686.0The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause CVE-2017-121697.5It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote CVE-2017-12176.1IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i CVE-2017-121709.8Downstream version 1.0.46-1 of pure-ftpd as shipped in Fedora was vulnerable to packaging error due to which the original configuration was CVE-2017-121716.5A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configurat CVE-2017-121726.7PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs CVE-2017-121738.8It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and w CVE-2017-121747.5It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created CVE-2017-121755.4Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.CVE-2017-121769.8xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X CVE-2017-121779.8xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X ser CVE-2017-121789.8xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server t