Secuity scan detects vulnerability for jmxremote.password.template: passwords in plain text

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

a Security has scanned a possible vulnerability in the file "jmxremote.password.template" located in  C:\Program Files (x86)\Nimsoft\jre\jre8u232b09\lib\management.

 

File contents: 

The "measureRole" role has
# password "QED".  The "controlRole" role has password "R&D".
#
# monitorRole  QED
# controlRole   R&D

 

 

These were detected as passwords in plain text. 

Environment

Release : UIM 20.x

Cause

Not vulnerable

Resolution

The file jmxremote.password.template present in C:\Program Files (x86)\Nimsoft\jre\jre8u232b09\lib\management does not represent a threat as there is no password in plain text. 

The file is simply a Java example source code file (jmxremote.password.template)

 

[JDK-6740543] Add support for encrypted passwords in the jmxremote.password file - Java Bug System (openjdk.org)

jdk7u-jdk/jmxremote.password.template at master · openjdk-mirror/jdk7u-jdk · GitHub