CVE-2021-20250: JBoss EJB Client information disclosure vulnerability
Summary
CVE-2021-20250: JBoss EJB Client information disclosure vulnerability. Affects org.jboss:jboss-ejb-client versions < 4.0.39. Fixed in 4.0.39. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The JBoss EJB Client is a component of the wildfly package. It is responsible for enabling communication between Java applications and remote EJB (Enterprise JavaBeans) servers. The JBoss EJB client provides a set of APIs and protocols for accessing and invoking EJB components deployed on a remote server. This vulnerability affects versions of the org.jboss:jboss-ejb-client package up to and including 4.0.38.
Vulnerability Detail
The JBoss EJB client in wildfly has a flaw that allows unauthorized access to privileged actions, leading to potential information disclosure on the server where it is deployed. This vulnerability poses a moderate threat to data confidentiality. An attacker with access to the publicly accessible privileged actions can exploit this vulnerability to gain unauthorized access to sensitive information stored on the server.
How To Fix
Minimum fixed version
4.0.39
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the org.jboss:jboss-ejb-client package to a secure version.
Conclusion
The JBoss EJB Client information disclosure vulnerability in wildfly can lead to unauthorized access to sensitive information on the server. It is recommended to upgrade the org.jboss:jboss-ejb-client package to version 4.0.39 or higher to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jboss:jboss-ejb-client →
FAQ
This vulnerability can lead to unauthorized access to sensitive information stored on the server where the JBoss EJB client is deployed.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, the CVSS score for this vulnerability is 4.3.
There are no known exploits for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate the risk.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-2259-h742-5vr4 at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-2259-h742-5vr4/GHSA-2259-h742-5vr4.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss:jboss-ejb-client.
