Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-3642

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

Published

2021-08-05T21:15:13.183

Last Modified

2024-11-21T06:22:03.467

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

6.8

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-203
  • Type: Secondary
    CWE-203
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application redhat wildfly_elytron < 1.10.14 Yes
Application redhat wildfly_elytron < 1.15.5 Yes
Application redhat wildfly_elytron < 1.16.1 Yes
Application redhat build_of_quarkus - Yes
Application redhat codeready_studio 12.0 Yes
Application redhat data_grid 8.0 Yes
Application redhat descision_manager 7.0 Yes
Application redhat integration_camel_k - Yes
Application redhat integration_camel_quarkus * Yes
Application redhat jboss_enterprise_application_platform 7.0.0 Yes
Application redhat jboss_enterprise_application_platform_expansion_pack - Yes
Application redhat jboss_fuse 7.0.0 Yes
Application redhat openshift_application_runtimes - Yes
Application redhat process_automation 7.0 Yes
Application quarkus quarkus ≤ 2.1.4 Yes
References