Read the docs
TI-2021-03542 Aliases CVE-2021-20250GHSA-2259-h742-5vr4

Information disclosure in wildfly

Priority LOW 21CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 7 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.

Why it matters now

EPSS 0.00743 54th percentileScored 2026-11-07
Fix Partial org.jboss:jboss-ejb-client (Maven): 4.0.39Red Hat: 7 advisoriesRed Hat: 7 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—wildflyjboss-ejb-client 4.0.39—No fix listedCNA
—org.jboss:jboss-ejb-client (Maven)before 4.0.394.0.39Patch availableGHSA-2259-h742-5vr4
  • wildfly Vendor— Affected jboss-ejb-client 4.0.39 Fixed in — No fix listed CNA
  • org.jboss:jboss-ejb-client (Maven) Vendor— Affected before 4.0.39 Fixed in 4.0.39 Patch available GHSA-2259-h742-5vr4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss-ejb-client:*:*:*:*:*:*:*:*before 4.0.39VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:jboss-ejb-client:*:*:*:*:*:*:*:* Versions before 4.0.39 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-2259-h742-5vr4 org.jboss:jboss-ejb-client (Maven) Fixed in 4.0.39 Advisory →

Red Hat 7 advisories

  • RHSA-2021:2755 Released 2021-07-15 · Red Hat rating Moderate
    EAP XP 2 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
  • RHSA-2021:2210 Released 2021-06-02 · Red Hat rating Moderate
    EAP XP 1 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP via EAP 7.3.x base
  • RHSA-2021:0974 Released 2021-03-23 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.6 security update
    • Red Hat Single Sign-On 7.4.6
Show 4 more Red Hat advisories
  • RHSA-2021:0872 Released 2021-03-16 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.6 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el6eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el6eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el6eap +47
  • RHSA-2021:0874 Released 2021-03-16 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.6 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el8eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el8eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el8eap +47
  • RHSA-2021:0873 Released 2021-03-16 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.6 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el7eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el7eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el7eap +47
  • RHSA-2021:0885 Released 2021-03-16 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.6 security update
    • Red Hat JBoss Enterprise Application Platform 7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat EAP-XP 2.0.0 via EAP 7.3.x baseFixed RHSA-2021:2755
Red Hat EAP-XP via EAP 7.3.x baseFixed RHSA-2021:2210
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:0874
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:0872
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:0873
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2021:0885
Red Hat Single Sign-On 7.4.6Fixed RHSA-2021:0974
Not affected: 4 products
  • Red Hat Decision Manager 7
  • Red Hat Fuse 7
  • Red Hat OpenShift Application Runtimes
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20250
  2. 2026-10-03 Alias added: GHSA-2259-h742-5vr4

References

Advisory 2

  • TI-2020-11168 Uncontrolled resource consumption in Red Hat wildfly CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences