Skip to content
Fencer Vulns
low 2.1

CVE-2009-3554 json

Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes th…

published 2009-12-15 16 y ago modified 2026-06-16 4 mo ago also EUVD-2009-3536

cvss
2.1
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits
0
none known

Summary

Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file.

Patch / fix

  • jacorb jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 2.3.0-1jpp.ep1.9.1.el5
  • quartz jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1.5.2-1jpp.patch01.ep1.4.1.el5
  • jbossas jboss enterprise application platform 4.2.0 4.2.0-5.GA_CP08.5.2.ep1.el5
  • jbossts jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el5
  • jcommon jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1.0.16-1.1.ep1.el5
  • jgroups jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1:2.4.7-1.ep1.el5
  • jbossweb jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 2.0.0-6.CP12.0jpp.ep1.2.el5
  • jboss-aop jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1.5.5-3.CP04.2.ep1.el5

red hat advisories RHSA-2009:1650RHSA-2009:1649RHSA-2009:1637RHSA-2009:1636

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2009-3554 updated cvss 2.1

JBoss EAP Twiddle logs the JMX password

  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jboss-seam 1.2.1-1.ep1.22.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, +20 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jboss-seam 1.2.1-1.ep1.22.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, +20 more
    fixed: vendor fix RHSA-2009:1637
  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jgroups 2.4.7-1.ep1.el5, jcommon 1.0.16-1.1.ep1.el5, jacorb 2.3.0-1jpp.ep1.9.1.el5, jboss-seam 1.2.1-1.ep1.14.el5, jfreechart 1.0.13-2.3.1.ep1.el5, glassfish-jsf 1.2_13-2.1.ep1.el5, +17 more
    fixed: vendor fix RHSA-2009:1650
  • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, jboss-aop 1.5.5-3.CP04.2.ep1.el4, +28 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, jboss-aop 1.5.5-3.CP04.2.ep1.el4, +28 more
    fixed: vendor fix RHSA-2009:1636
  • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jgroups 2.4.7-1.ep1.el5, jcommon 1.0.16-1.1.ep1.el5, jacorb 2.3.0-1jpp.ep1.9.1.el5, jfreechart 1.0.13-2.3.1.ep1.el5, glassfish-jsf 1.2_13-2.1.ep1.el5, jboss-aop 1.5.5-3.CP04.2.ep1.el5, +25 more
    fixed: vendor fix RHSA-2009:1649

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.