CVE-2014-8122: Information disclosure in JBoss Weld
Summary
CVE-2014-8122: Information disclosure in JBoss Weld. Affects org.jboss.weld:weld-core-bom versions < 2.2.8. Fixed in 2.2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JBoss Weld is a Java-based framework that implements the Contexts and Dependency Injection for Java EE (CDI) specification. It provides a powerful set of tools and features for managing contextual instances and dependency injection in Java EE applications. The weld-core-bom package is a Bill of Materials (BOM) for managing dependencies in Weld projects.
Vulnerability Detail
This vulnerability, identified as CVE-2014-8122, is an information disclosure issue in JBoss Weld before version 2.2.8 and 3.x before 3.0.0 Alpha3. It arises due to a race condition that allows remote attackers to obtain information from a previous conversation. This can be exploited by leveraging vectors related to a stale thread state. The vulnerability has a moderate severity rating and is classified under CWE-362.
How To Fix
Minimum fixed version
2.2.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, CVE-2014-8122 is an information disclosure vulnerability in JBoss Weld. It can be mitigated by upgrading the weld-core-bom package to version 2.2.8 or later. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jboss.weld:weld-core-bom →
FAQ
JBoss Weld is a Java-based framework that implements the Contexts and Dependency Injection for Java EE (CDI) specification. It provides tools and features for managing contextual instances and dependency injection in Java EE applications.
This vulnerability allows remote attackers to obtain information from a previous conversation, potentially exposing sensitive data. However, it requires leveraging vectors related to a stale thread state.
This vulnerability has a moderate severity rating.
CWE-362 is a Common Weakness Enumeration category that encompasses vulnerabilities related to concurrent execution.
To fix this vulnerability, you should upgrade the weld-core-bom package to version 2.2.8 or later by updating the relevant dependency in your project's Maven configuration file (pom.xml).
