Read the docs
TI-2021-02624 Aliases CVE-2021-3688GHSA-f3rq-463v-2j36

Information disclosure in Red Hat JBCS HTTP Server

Priority LOW 23CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolon(s). This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

Why it matters now

EPSS 0.00568 47th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Red Hat JBCS HTTP ServerFixed in jbcs-httpd-2.4.37.SP10 GA—No fix listedCNA
  • Red Hat JBCS HTTP Server Vendor— Affected Fixed in jbcs-httpd-2.4.37.SP10 GA Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_core_services_httpd:*:*:*:*:*:*:*:*before 2.4.37VulnerableRed Hat
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:-:*:*:*:*:*:*2.4.37VulnerableRed Hat
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp1:*:*:*:*:*:*2.4.37 sp1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp2:*:*:*:*:*:*2.4.37 sp2VulnerableRed Hat
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp3:*:*:*:*:*:*2.4.37 sp3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp4:*:*:*:*:*:*2.4.37 sp4VulnerableRed Hat
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp5:*:*:*:*:*:*2.4.37 sp5VulnerableRed Hat
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp6:*:*:*:*:*:*2.4.37 sp6VulnerableRed Hat
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp7:*:*:*:*:*:*2.4.37 sp7VulnerableRed Hat
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp8:*:*:*:*:*:*2.4.37 sp8VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:*:*:*:*:*:*:*:* Versions before 2.4.37 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:-:*:*:*:*:*:* Versions 2.4.37 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp1:*:*:*:*:*:* Versions 2.4.37 sp1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp2:*:*:*:*:*:* Versions 2.4.37 sp2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp3:*:*:*:*:*:* Versions 2.4.37 sp3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp4:*:*:*:*:*:* Versions 2.4.37 sp4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp5:*:*:*:*:*:* Versions 2.4.37 sp5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp6:*:*:*:*:*:* Versions 2.4.37 sp6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp7:*:*:*:*:*:* Versions 2.4.37 sp7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp8:*:*:*:*:*:* Versions 2.4.37 sp8 Vulnerable ·Red Hat
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp9:*:*:*:*:*:*2.4.37 sp9VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_core_services_httpd:2.4.37:sp9:*:*:*:*:*:* Versions 2.4.37 sp9 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2021:4614 Released 2021-11-10 · Red Hat rating Moderate
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-107.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-107.jbcs.el7, jbcs-httpd24-apr-util-1.6.1-84.jbcs.el7 +36
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-1.6.3-107.el8jbcs, jbcs-httpd24-apr-devel-1.6.3-107.el8jbcs, jbcs-httpd24-apr-util-1.6.1-84.el8jbcs +36
  • RHSA-2021:4613 Released 2021-11-10 · Red Hat rating Moderate
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update
    • Red Hat JBoss Core Services

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Core ServicesFixed RHSA-2021:4613
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2021:4614
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2021:4614
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3688
  2. 2026-10-03 Alias added: GHSA-f3rq-463v-2j36

References

Advisory 2

  • TI-2020-15696 Improper certificate validation in JBCS httpd CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences