CVE-2020-25640: 
Java vulnerability analysis and mitigation

A vulnerability was discovered in WildFly versions before 21.0.0.Final where the Resource adapter logs plain text JMS password at warning level when a connection error occurs, potentially exposing sensitive information in log files (NVD, Red Hat CVE).

The vulnerability occurs when the JMS connection encounters an error, causing the resource adapter to log the connection details including the password in plaintext at warning level. This exposes sensitive authentication credentials in the system log files. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

Successful exploitation of this vulnerability could lead to the disclosure of sensitive information, specifically JMS authentication credentials. The exposed passwords in log files could potentially be used by attackers to gain unauthorized access to the messaging system (NetApp Security).

The vulnerability can be triggered when a connection error occurs in the JMS system. A specific example shows the password being exposed twice in the same log message, making it easily discoverable in log files (GitHub Issue).

The vulnerability has been fixed in WildFly version 21.0.0.Final. Users are advised to upgrade to this version or later to address the issue. The fix has been incorporated into multiple products including Red Hat JBoss Enterprise Application Platform through various security advisories (Red Hat Errata).