CVE-2016-7043: Password in Configuration File

May 24, 2022 (updated February 14, 2023)

It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7043
github.com/advisories/GHSA-pjw3-c74j-m9fj
github.com/kiegroup/droolsjbpm-integration/pull/1273
nvd.nist.gov/vuln/detail/CVE-2016-7043

Code Behaviors & Features

Detect and mitigate CVE-2016-7043 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →