Medium severity · published Jun 1, 2021
CVE-2021-20306
A flaw was found in the BPMN editor in version jBPM 7.51.0.Final
4.3
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Descision Manager · Redhat
7.0 · source: NVD
JB
Jbpm · Redhat
7.51.0 · source: NVD
PA
Process Automation · Redhat
7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20306
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20306
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1946213
More from Descision Manager
7.5
CVE-2019-14839
It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using some tool like burp…
7.5
CVE-2022-0853
A flaw was found in JBoss-client
7.5
CVE-2020-10714
A flaw was found in WildFly Elytron version 1.11.3.Final and before
7.4
CVE-2021-20218
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after
6.7
CVE-2021-4178
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above