Medium severity · published Aug 23, 2022
CVE-2021-3763
A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the role the user is…
4.3
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the role the user is assigned to should not be allow access to the management console. The main impact is to confidentiality as this flaw means some role bindings are incorrectly checked, some privileged meta information such as queue names and configuration details are disclosed but the impact is limited as not all information is accessible and there is no affect to integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Amq Broker · Redhat
7.8.0; 7.8.1; 7.8.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3763
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3763
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3763
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2000654
Vendor Advisory
https://issues.redhat.com/browse/ENTMQBR-5372
More from Amq Broker
8.8
CVE-2022-1833
A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace where the AMQ Operator is deployed has…
5.3
CVE-2021-4040
A flaw was found in AMQ Broker
