PT-2022-10589 · Red Hat · Red Hat Jboss Core Services Http Server

Ted Jongseok Won · Published 2022-08-26 · Updated 2023-02-12 · CVE-2021-3688

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Core Services HTTP Server (affected versions not specified)

Description A flaw was found in Red Hat JBoss Core Services HTTP Server where it does not properly normalize the path component of a request URL containing dot-dot-semicolon(s). This could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this issue is to data confidentiality and integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Path traversal

Weakness Enumeration

CWE-200

CWE-22

Related Identifiers

CVE-2021-3688

RHSA-2021:4614

Affected Products

Red Hat Jboss Core Services Http Server

References · 6

• https://osv.dev/vulnerability/CVE-2021-3688 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3688 · Security Note
• https://access.redhat.com/security/cve/CVE-2021-3688 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1990252 · Vendor Advisory
• https://t.me/cibsecurity/48887 · Telegram Post
• https://t.me/cvenotify/35536 · Telegram Post