Vulnerability · Published Aug 23, 2022 · Assigned by redhat

CVE-2021-3763

Medium 4.3

In plain English

A medium-severity incorrect authorization in AMQ Broker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.7%top 46.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the role the user is assigned to should not be allow access to the management console. The main impact is to confidentiality as this flaw means some role bindings are incorrectly checked, some privileged meta information such as queue names and configuration details are disclosed but the impact is limited as not all information is accessible and there is no affect to integrity.

Affected products (as reported)

Vendor	Product	Versions
n/a	AMQ Broker	Fixed in amq-7.9.0

Weakness: CWE-863

References

https://bugzilla.redhat.com/show_bug.cgi?id=2000654 x_refsource_MISC
https://issues.redhat.com/browse/ENTMQBR-5372 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2021-3763 x_refsource_MISC