PT-2022-10661 · Red Hat · Red Hat Amq Broker

Alfredo Narvaez · Published 2022-08-23 · Updated 2022-08-27 · CVE-2021-3763

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat AMQ Broker version 7.8

Description A flaw in the management console allows an existing user to access limited information, despite their role not being allowed access. This affects confidentiality due to incorrect role binding checks, disclosing privileged meta information like queue names and configuration details, though not all information is accessible. There is no impact on integrity.

Recommendations For Red Hat AMQ Broker version 7.8, consider restricting access to the management console until a fix is available. As a temporary workaround, review and adjust role bindings to minimize the disclosure of privileged information.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-3763

Affected Products

Red Hat Amq Broker

References · 6

• https://access.redhat.com/security/cve/CVE-2021-3763 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3763 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2000654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3763 · Security Note
• https://issues.redhat.com/browse/ENTMQBR-5372 · Vendor Advisory
• https://t.me/cibsecurity/48589 · Telegram Post