Read the docs
TI-2009-03391 Aliases CVE-2009-3554GHSA-p46q-pmw2-55mw

Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2…

Priority LOW 11CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file.

Why it matters now

EPSS 0.00383 32nd percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:*:*:*:*:*:*:*4.2VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:cp01:*:*:*:*:*:*4.2 cp01VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:cp02:*:*:*:*:*:*4.2 cp02VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp01:*:*:*:*:*:*4.2.0 cp01VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp02:*:*:*:*:*:*4.2.0 cp02VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp03:*:*:*:*:*:*4.2.0 cp03VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp04:*:*:*:*:*:*4.2.0 cp04VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp05:*:*:*:*:*:*4.2.0 cp05VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp06:*:*:*:*:*:*4.2.0 cp06VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp07:*:*:*:*:*:*4.2.0 cp07VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:cp01:*:*:*:*:*:* Versions 4.2 cp01 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:cp02:*:*:*:*:*:* Versions 4.2 cp02 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp01:*:*:*:*:*:* Versions 4.2.0 cp01 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp02:*:*:*:*:*:* Versions 4.2.0 cp02 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp03:*:*:*:*:*:* Versions 4.2.0 cp03 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp04:*:*:*:*:*:* Versions 4.2.0 cp04 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp05:*:*:*:*:*:* Versions 4.2.0 cp05 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp06:*:*:*:*:*:* Versions 4.2.0 cp06 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp07:*:*:*:*:*:* Versions 4.2.0 cp07 Vulnerable ·Red Hat
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.2:ga:*:*:*:*:*:*4.2.2 gaVulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.2:ga:*:*:*:*:*:* Versions 4.2.2 ga Vulnerable ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2009:1650 Released 2009-12-10 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.2.0.CP08 update
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server glassfish-jsf-1.2_13-2.1.ep1.el5, hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5, hibernate3-annotations-3.3.1-1.11GA_CP02.ep1.el5 +22
  • RHSA-2009:1649 Released 2009-12-09 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.3.0.CP07 update
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server glassfish-jaxb-2.1.4-1.12.patch03.1.ep1.el5, glassfish-jaxb-javadoc-2.1.4-1.12.patch03.1.ep1.el5, glassfish-jsf-1.2_13-2.1.ep1.el5 +31
  • RHSA-2009:1637 Released 2009-12-09 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.2.0.CP08 update
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jsf-1.2_13-2.1.ep1.el4, hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4 +25
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jsf-1.2_13-2.1.ep1.el4, hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4 +25
Show 1 more Red Hat advisories
  • RHSA-2009:1636 Released 2009-12-09 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.3.0.CP07 update
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jaxb-2.1.4-1.12.patch03.ep1.el4, glassfish-jaxb-javadoc-2.1.4-1.12.patch03.ep1.el4 +34
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jaxb-2.1.4-1.12.patch03.ep1.el4, glassfish-jaxb-javadoc-2.1.4-1.12.patch03.ep1.el4 +34

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ASFixed RHSA-2009:1637
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ESFixed RHSA-2009:1637
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 ServerFixed RHSA-2009:1650
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ASFixed RHSA-2009:1636
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ESFixed RHSA-2009:1636
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 ServerFixed RHSA-2009:1649

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-3554
  2. 2026-10-03 Alias added: GHSA-p46q-pmw2-55mw

References

Patch 2

Advisory 4

Other 2

  • TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
  • TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 243 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences