Skip to content
Fencer Intel
low 2.1

CVE-2014-0059 json

JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audi…

published 2014-11-17 11 y ago modified 2026-06-17 4 mo ago also EUVD-2014-0152

cvss
2.1
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file.

Patch / fix

  • hornetq jboss enterprise application platform 6 2.3.14.1-1.Final_redhat_1.1.ep6.el5
  • resteasy jboss enterprise application platform 6 2.3.7.1-1.Final_redhat_1.1.ep6.el5
  • picketbox jboss enterprise application platform 6 4.0.19-6.SP6_redhat_1.1.ep6.el5
  • weld-core jboss enterprise application platform 6 1.1.17-3.SP2_redhat_1.1.ep6.el5
  • jboss-as-ee jboss enterprise application platform 6 7.3.3-3.Final_redhat_3.1.ep6.el5
  • jboss-as-cli jboss enterprise application platform 6 7.3.3-3.Final_redhat_3.1.ep6.el5
  • jboss-as-cmp jboss enterprise application platform 6 7.3.3-3.Final_redhat_3.1.ep6.el5
  • jboss-as-jdr jboss enterprise application platform 6 7.3.3-3.Final_redhat_3.1.ep6.el5

red hat advisories RHSA-2014:0564RHSA-2014:0563

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-0059 updated cvss 2.1

JBossSX/PicketBox: World readable audit.log file

  • Red Hat JBoss Data Virtualization 6 eap eap Red Hat JBoss Fuse Service Works 6 eap eap
    affected: no fix available
  • Red Hat JBoss BPMS 6.0
    fixed: vendor fix RHSA-2015:0851
  • Red Hat JBoss BRMS 6.0
    fixed: vendor fix RHSA-2015:0850
  • Red Hat JBoss Data Grid 6.3
    fixed: vendor fix RHSA-2014:0895
  • Red Hat JBoss Data Virtualization 6.1
    fixed: vendor fix RHSA-2015:0675
  • Red Hat JBoss Enterprise Application Platform 6.2
    fixed: vendor fix RHSA-2014:0565
  • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server picketbox 4.0.19-6.SP6_redhat_1.1.ep6.el5, weld-core 1.1.17-3.SP2_redhat_1.1.ep6.el5, hornetq 2.3.14.1-1.Final_redhat_1.1.ep6.el5, resteasy 2.3.7.1-1.Final_redhat_1.1.ep6.el5, jboss-as-ee 7.3.3-3.Final_redhat_3.1.ep6.el5, jboss-as-cli 7.3.3-3.Final_redhat_3.1.ep6.el5, +84 more
    fixed: vendor fix RHSA-2014:0564
  • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server picketbox 4.0.19-6.SP6_redhat_1.1.ep6.el6, weld-core 1.1.17-3.SP2_redhat_1.1.ep6.el6, hornetq 2.3.14.1-1.Final_redhat_1.1.ep6.el6, resteasy 2.3.7.1-1.Final_redhat_1.1.ep6.el6, jboss-as-ee 7.3.3-3.Final_redhat_3.1.ep6.el6, jboss-as-cli 7.3.3-3.Final_redhat_3.1.ep6.el6, +84 more
    fixed: vendor fix RHSA-2014:0563
show 2 more

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.