Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Red Hat JBoss EAP 7.3 may let attackers bypass access controls
published 2 years ago
Summary
The JBoss Enterprise Application Platform version 7.3 can be tricked into bypassing its normal access checks, potentially allowing unauthorized users to view or change data. This could expose sensitive business information or disrupt services. Apply the latest Red Hat security update for JBoss EAP 7.3 as soon as possible to close the gap.
What to do
- Update redhat eap7-undertow to version 0:2.0.41-2.SP2_redhat_00001.1.el6eap.
- Update redhat eap7-undertow to version 0:2.0.41-2.SP2_redhat_00001.1.el7eap.
- Update redhat eap7-undertow to version 0:2.0.41-2.SP2_redhat_00001.1.el8eap.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:jboss_enterprise_application_platform:7.3::el6 | redhat | eap7-undertow |
< 0:2.0.41-2.SP2_redhat_00001.1.el6eap Fix: upgrade to 0:2.0.41-2.SP2_redhat_00001.1.el6eap
|
| Red Hat:jboss_enterprise_application_platform:7.3::el7 | redhat | eap7-undertow |
< 0:2.0.41-2.SP2_redhat_00001.1.el7eap Fix: upgrade to 0:2.0.41-2.SP2_redhat_00001.1.el7eap
|
| Red Hat:jboss_enterprise_application_platform:7.3::el8 | redhat | eap7-undertow |
< 0:2.0.41-2.SP2_redhat_00001.1.el8eap Fix: upgrade to 0:2.0.41-2.SP2_redhat_00001.1.el8eap
|
Original advisory text
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update
References
- https://access.redhat.com/errata/RHSA-2022:0405 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_applicati... Third Party Advisory
- https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_applicati... Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2010378 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0405.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2021-3859 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-3859 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-3859 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published13 Sep 2024
Updated2 Oct 2026
First seen2 Oct 2026
Sources
RHSA-2022:0405 · OSV
Track software like this
Free during beta