CVE Vulnerability

CVE-2021-3688

A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolon(s). This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

4.8 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2021-3688 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1990252 Issue Tracking Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp3:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:-:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp1:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp2:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp4:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp5:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp6:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp7:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp8:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp9:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services_httpd:*:*:*:*:*:*:*:*
Information

Published : 2022-08-26 04:15

Updated : 2023-02-12 11:42

NVD link : CVE-2021-3688

Mitre link : CVE-2021-3688

Products Affected
No products.
CWE
CWE-200