Medium severity · published May 13, 2021
CVE-2021-20250
A flaw was found in wildfly
4.3
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jboss Enterprise Application Platform Expansion Pack · Redhat
All versions, or not specified · source: NVD
JB
Jboss-ejb-client · Redhat
before 4.0.39 · source: NVD
Affected product
JE
Jboss Enterprise Application Platform Expansion Pack
Redhat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20250
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1929479
More from Jboss Enterprise Application Platform Expansion Pack
9.6
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.1
CVE-2026-28369
Undertow: undertow: request smuggling via malformed http request headers
9.1
CVE-2026-28367
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
9.1
CVE-2026-28368
Undertow: undertow: request smuggling via inconsistent header parsing
8.1
CVE-2026-18967
Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow