CVE-2021-20250

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-202515.9A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if speCVE-2021-202526.5A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested dateCVE-2021-202536.7A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilCVE-2021-202546.8A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that perCVE-2021-202555.5A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while pCVE-2021-202565.3A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local attacker with view_hCVE-2021-202576.5An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in procCVE-2021-202597.8A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attackeCVE-2021-20268.2Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are CVE-2021-202607.8A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with CVE-2021-202616.4A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issueCVE-2021-202626.8A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take