Lucene search

GoogleOSV:GHSA-2259-H742-5VR4

HistoryMay 24, 2022 - 7:02 p.m.

JBoss EJB Client information disclosure vulnerability

2022-05-2419:02:23

Google

osv.dev

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

21.4%

JSON

A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.

CPENameOperatorVersion
org.jboss:jboss-ejb-clienteq4.0.0.Beta27
org.jboss:jboss-ejb-clienteq1.0.15.Final
org.jboss:jboss-ejb-clienteq4.0.18.Final
org.jboss:jboss-ejb-clienteq1.0.38.Final
org.jboss:jboss-ejb-clienteq1.0.35.Final
org.jboss:jboss-ejb-clienteq1.0.41.Final
org.jboss:jboss-ejb-clienteq4.0.35.Final
org.jboss:jboss-ejb-clienteq2.0.0.Final
org.jboss:jboss-ejb-clienteq4.0.0.Beta11
org.jboss:jboss-ejb-clienteq4.0.0.CR4

Name	Operator	Version
org.jboss:jboss-ejb-client	eq	4.0.0.Beta27
org.jboss:jboss-ejb-client	eq	1.0.15.Final
org.jboss:jboss-ejb-client	eq	4.0.18.Final
org.jboss:jboss-ejb-client	eq	1.0.38.Final
org.jboss:jboss-ejb-client	eq	1.0.35.Final
org.jboss:jboss-ejb-client	eq	1.0.41.Final
org.jboss:jboss-ejb-client	eq	4.0.35.Final
org.jboss:jboss-ejb-client	eq	2.0.0.Final
org.jboss:jboss-ejb-client	eq	4.0.0.Beta11
org.jboss:jboss-ejb-client	eq	4.0.0.CR4

Rows per page:

1-10 of 1571

References

bugzilla.redhat.com/show_bug.cgi?id=1929479

nvd.nist.gov/vuln/detail/CVE-2021-20250

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

21.4%

JSON

Related for OSV:GHSA-2259-H742-5VR4