Read the docs
TI-2009-04820 Aliases CVE-2009-5066GHSA-2g9h-3ggp-8xg3

twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line…

Priority LOW 11CWE-255Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 8 fixed, 3 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.

Why it matters now

EPSS 0.00387 32nd percentileScored 2026-11-07
Fix Partial Red Hat: 10 advisoriesRed Hat: 8 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_community_application_server:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_community_application_server:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat

Remediation

Red Hat 10 advisories

  • RHSA-2013:0533 Released 2013-02-20 · Red Hat rating Important
    JBoss Enterprise SOA Platform 5.3.1 update
    • Red Hat JBoss SOA Platform 5.3
  • RHSA-2013:0221 Released 2013-01-31 · Red Hat rating Important
    JBoss Enterprise BRMS Platform 5.3.1 update
    • JBoss Enterprise BRMS Platform 5.3
  • RHSA-2013:0198 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5.2
Show 7 more Red Hat advisories
  • RHSA-2013:0197 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5 for RHEL 4 AS aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
    • Red Hat JBoss Web Platform 5 for RHEL 4 ES aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
  • RHSA-2013:0196 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5 for RHEL 5 Server aopalliance-1.0-5.2.jdk6.ep5.el5, apache-cxf-2.2.12-6.1.patch_04.ep5.el5, bsh2-2.0-0.b4.15.1.patch01.ep5.el5 +47
  • RHSA-2013:0195 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5 for RHEL 6 Server aopalliance-1.0-5.3.ep5.el6, apache-cxf-2.2.12-6.1.patch_04.ep5.el6, bsh2-2.0-0.b4.15.patch01.ep5.el6 +47
  • RHSA-2013:0193 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
  • RHSA-2013:0191 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server aopalliance-1.0-5.3.ep5.el6, apache-cxf-2.2.12-6.1.patch_04.ep5.el6, bsh2-2.0-0.b4.15.patch01.ep5.el6 +47
  • RHSA-2013:0192 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server aopalliance-1.0-5.2.jdk6.ep5.el5, apache-cxf-2.2.12-6.1.patch_04.ep5.el5, bsh2-2.0-0.b4.15.1.patch01.ep5.el5 +47
  • RHSA-2013:0194 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5.2

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss BRMS 5AffectedNo fix yet
Red Hat JBoss Portal 5AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 5AffectedNo fix yet
JBoss Enterprise BRMS Platform 5.3Fixed RHSA-2013:0221
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2013:0192
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2013:0191
Red Hat JBoss Enterprise Application Platform 5.2Fixed RHSA-2013:0194
Red Hat JBoss SOA Platform 5.3Fixed RHSA-2013:0533
Red Hat JBoss Web Platform 5 for RHEL 5 ServerFixed RHSA-2013:0196
Red Hat JBoss Web Platform 5 for RHEL 6 ServerFixed RHSA-2013:0195
Red Hat JBoss Web Platform 5.2Fixed RHSA-2013:0198

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-5066
  2. 2026-10-03 Alias added: GHSA-2g9h-3ggp-8xg3

References

Advisory 10

Other 4

  • TI-2012-03869 The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x… CVSS 2.0MEDIUM 4.3
  • TI-2012-01921 An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences