CVE-2021-40684

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running in the container.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://help.talend.com/r/en-US/7.3/release-notes-esb-productsRelease Notes, Vendor Advisory
https://jira.talendforge.org/browse/SF-141Patch, Vendor Advisory
https://help.talend.com/r/en-US/7.3/release-notes-esb-productsRelease Notes, Vendor Advisory
https://jira.talendforge.org/browse/SF-141Patch, Vendor Advisory

Timeline

Published: Sep 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-40697.8vim is vulnerable to Use After Free CVE-2021-406907.5All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" pr CVE-2021-406914.3A session hijack risk was identified in the Shibboleth authentication plugin.CVE-2021-406924.3Insufficient capability checks made it possible for teachers to download users outside of their courses.CVE-2021-406936.5An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.CVE-2021-406944.9Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system accou CVE-2021-406954.3It was possible for a student to view their quiz grade before it had been released, using a quiz web service.CVE-2021-406973.3Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerab CVE-2021-406987.4ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vu CVE-2021-406997.4ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability w CVE-2021-40709.1Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.CVE-2021-407007.8Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a ma