CVE-2021-3688

State: Published
Severity: Not scored
Published: Aug 26, 2022
Updated: Aug 3, 2024
Reserved: Aug 5, 2021

Description

A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolon(s). This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

Scores

The record has no CVSS score.

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Red Hat JBCS HTTP Servern/a	Fixed in jbcs-httpd-2.4.37.SP10 GAAffected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1990252
https://access.redhat.com/security/cve/CVE-2021-3688

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.