What is the CVSS score of CVE-2021-3642?

CVE-2021-3642 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Is there a patch available for CVE-2021-3642?

Yes, a patch is available for CVE-2021-3642. Update the affected software to the latest version immediately.

Wildfly Elytron CVE-2021-3642

MEDIUM

Observable Discrepancy (CWE-203)

2021-08-05 secalert@redhat.com

Information Disclosure Wildfly Elytron Build Of Quarkus Codeready Studio Data Grid Descision Manager Integration Camel K Integration Camel Quarkus Jboss Enterprise Application Platform Jboss Enterprise Application Platform Expansion Pack Jboss Fuse Openshift Application Runtimes Process Automation Quarkus

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Aug 05, 2021 - 21:15 nvd

MEDIUM 5.3

DescriptionNVD

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

AnalysisAI

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-203. A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. Affected products include: Redhat Wildfly Elytron, Redhat Build Of Quarkus, Redhat Codeready Studio, Redhat Data Grid, Redhat Descision Manager. Version information: prior to 1.10.14..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.