CVE-2021-20306

CWE-863 — Incorrect Authorization4 documents4 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 67.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Redhat Descision ManagerRedhat JbpmRedhat Process Automation
Timeline
PublishedJun 1
Latest updateMay 24

Description

A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDredhat/jbpm7.51.0
▶CVEListV5business-centraljBPM 7.51.0.Final

🔴Vulnerability Details

2
GHSA
GHSA-vjmm-vxxf-qmx4: A flaw was found in the BPMN editor in version jBPM 7↗2022-05-24
▶
CVEList
CVE-2021-20306: A flaw was found in the BPMN editor in version jBPM 7↗2021-06-01
▶

📋Vendor Advisories

1
Red Hat
Business-central: Ruleflow Groups from other projects displayed on BPMN editor despite user having no access to those projects↗2021-04-05
▶
CVE-2021-20306 (MEDIUM CVSS 4.3) | A flaw was found in the BPMN editor | cvebase.io