Skip to content
Fencer Intel
medium 4.3

CVE-2021-20250 json

JBoss EJB Client information disclosure vulnerability

published 5y ago modified 4mo ago also GHSA-2259-h742-5vr4 , EUVD-2022-1875

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.

Patch / fix

  • maven org.jboss:jboss-ejb-client 4.0.39
  • redhat jboss-ejb-client 4.0.39
  • eap7-guava jboss enterprise application platform 7.3 30.1.0-1.redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.3 7.3.6-1.GA_redhat_00002.1.el7eap
  • eap7-narayana jboss enterprise application platform 7.3 5.9.11-1.Final_redhat_00001.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.3 2.0.34-1.SP1_redhat_00001.1.el7eap
  • eap7-hal-console jboss enterprise application platform 7.3 3.2.13-1.Final_redhat_00001.1.el7eap
  • eap7-ironjacamar jboss enterprise application platform 7.3 1.4.27-1.Final_redhat_00001.1.el7eap
  • eap7-bouncycastle jboss enterprise application platform 7.3 1.68.0-1.redhat_00001.1.el7eap
  • eap7-jboss-remoting jboss enterprise application platform 7.3 5.0.20-2.SP1_redhat_00001.1.el7eap

red hat advisories RHSA-2021:0873RHSA-2021:0874RHSA-2021:0872

Is CVE-2021-20250 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20250 updated cvss 4.3

wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client

  • Red Hat JBoss Data Grid 7 jboss-ejb-client Red Hat JBoss Enterprise Application Platform 6 jboss-ejb-client
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack jboss-ejb-client
    affected: no fix available
  • Red Hat JBoss Fuse 6 jboss-ejb-client Red Hat JBoss Fuse Service Works 6 jboss-ejb-client Red Hat JBoss Operations Network 3 jboss-ejb-client
    affected: no fix planned “Out of support scope”
  • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
    fixed: vendor fix RHSA-2021:2755
  • Red Hat EAP-XP via EAP 7.3.x base
    fixed: vendor fix RHSA-2021:2210
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-guava 30.1.0-1.redhat_00001.1.el8eap, eap7-wildfly 7.3.6-1.GA_redhat_00002.1.el8eap, eap7-bouncycastle 1.68.0-1.redhat_00001.1.el8eap, eap7-undertow 2.0.34-1.SP1_redhat_00001.1.el8eap, eap7-narayana 5.9.11-1.Final_redhat_00001.1.el8eap, eap7-activemq-artemis 2.9.0-9.redhat_00019.1.el8eap, +75 more
    fixed: vendor fix RHSA-2021:0874
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-guava 30.1.0-1.redhat_00001.1.el6eap, eap7-wildfly 7.3.6-1.GA_redhat_00002.1.el6eap, eap7-bouncycastle 1.68.0-1.redhat_00001.1.el6eap, eap7-undertow 2.0.34-1.SP1_redhat_00001.1.el6eap, eap7-narayana 5.9.11-1.Final_redhat_00001.1.el6eap, eap7-activemq-artemis 2.9.0-9.redhat_00019.1.el6eap, +75 more
    fixed: vendor fix RHSA-2021:0872
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-guava 30.1.0-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.6-1.GA_redhat_00002.1.el7eap, eap7-bouncycastle 1.68.0-1.redhat_00001.1.el7eap, eap7-undertow 2.0.34-1.SP1_redhat_00001.1.el7eap, eap7-narayana 5.9.11-1.Final_redhat_00001.1.el7eap, eap7-activemq-artemis 2.9.0-9.redhat_00019.1.el7eap, +77 more
    fixed: vendor fix RHSA-2021:0873
show 3 more
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2021:0885
  • Red Hat Single Sign-On 7.4.6
    fixed: vendor fix RHSA-2021:0974
  • Red Hat Decision Manager 7 jboss-ejb-client Red Hat Fuse 7 jboss-ejb-client Red Hat OpenShift Application Runtimes jboss-ejb-client Red Hat Process Automation 7 jboss-ejb-client
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.jboss:jboss-ejb-client
<4.0.39
4.0.39

Affected products

  • n/a wildfly

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.