CVE-2021-20306
published 2021-06-01CVE-2021-20306: A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.66%
47.2th percentile
A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | descision_manager | — | — |
| redhat | jbpm | — | — |
| redhat | process_automation | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vjmm-vxxf-qmx4: A flaw was found in the BPMN editor in version jBPM 7
ghsa_unreviewed·2022-05-24
CVE-2021-20306 [MEDIUM] CWE-863 GHSA-vjmm-vxxf-qmx4: A flaw was found in the BPMN editor in version jBPM 7
A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.
Red Hat
Business-central: Ruleflow Groups from other projects displayed on BPMN editor despite user having no access to those projects
vendor_redhat·2021-04-05·CVSS 4.3
CVE-2021-20306 [MEDIUM] CWE-863 Business-central: Ruleflow Groups from other projects displayed on BPMN editor despite user having no access to those projects
Business-central: Ruleflow Groups from other projects displayed on BPMN editor despite user having no access to those projects
A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.
A flaw was found in the BPMN editor. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.
Package: Business-central (Red Hat Decision Manager 7) - Fix deferred
Package: Business-central (Red Hat Process Automation 7) - Fix
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-06-01
Published