Vulnerability-Lookup

WID-SEC-W-2022-0607

Vulnerability from csaf_certbund - Published: 2022-07-07 22:00 - Updated: 2025-05-04 22:00

Summary

Red Hat FUSE: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Red Hat Fuse ist eine Open-Source-Integrationsplattform, die auf Apache Camel basiert.

Angriff: Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.

Betroffene Betriebssysteme: - Linux - UNIX

CVE-2020-15250

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2020-25689

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2020-29582

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2020-36518

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2020-7020

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2020-9484

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-22060

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-22096

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-22119

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-22569

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-22573

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-24122

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-2471

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-25122

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-25329

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-29505

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-30640

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-33037

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-33813

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-35515

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-35516

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-35517

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-36090

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-3629

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-3642

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-3644

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-3807

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-38153

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-3859

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-40690

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-41079

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-41766

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-4178

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-42340

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-42550

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-43797

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2021-43859

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-0084

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-1259

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-1319

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-21363

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-21724

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-22932

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-22950

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-22968

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-22970

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-22971

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-22976

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-22978

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-23181

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-23221

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-23596

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-23913

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-24614

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-25845

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-26336

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-26520

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

CVE-2022-30126

Affected products

Known affected 11 products

Product	Identifier	Version
IBM QRadar SIEM 7.5 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.5`	7.5
EMC Avamar EMC	`cpe:/a:emc:avamar:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Red Hat JBoss Enterprise Application Platform <7.1.10 Red Hat / JBoss Enterprise Application Platform		<7.1.10
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat FUSE <7.11.0 Red Hat / FUSE		<7.11.0
IBM QRadar SIEM 7.4 IBM / QRadar SIEM	`cpe:/a:ibm:qradar_siem:7.4`	7.4
NetApp ActiveIQ Unified Manager NetApp	`cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~`	—
IBM Spectrum Protect Plus 10.1 IBM / Spectrum Protect	`cpe:/a:ibm:spectrum_protect:plus_10.1`	Plus 10.1
Hitachi Ops Center Hitachi	`cpe:/a:hitachi:ops_center:-`	—
Red Hat JBoss Enterprise Application Platform <7.3.13 Red Hat / JBoss Enterprise Application Platform		<7.3.13

References

35 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://access.redhat.com/errata/RHSA-2022:5532	external
https://access.redhat.com/errata/RHSA-2022:5596	external
https://www.hitachi.co.jp/Prod/comp/soft1/global/…	external
https://www.hitachi.co.jp/Prod/comp/soft1/global/…	external
https://lists.debian.org/debian-security-announce…	external
https://access.redhat.com/errata/RHSA-2022:5903	external
https://access.redhat.com/errata/RHSA-2022:6787	external
https://access.redhat.com/errata/RHSA-2022:6783	external
https://access.redhat.com/errata/RHSA-2022:6782	external
https://access.redhat.com/errata/RHSA-2022:6822	external
https://access.redhat.com/errata/RHSA-2022:6823	external
https://access.redhat.com/errata/RHSA-2022:6825	external
https://access.redhat.com/errata/RHSA-2022:6821	external
https://access.redhat.com/errata/RHSA-2022:6813	external
https://access.redhat.com/errata/RHSA-2022:6835	external
https://security.netapp.com/advisory/ntap-2022101…	external
https://www.ibm.com/blogs/psirt/security-bulletin…	external
https://access.redhat.com/errata/RHSA-2022:7177	external
https://access.redhat.com/errata/RHSA-2022:7257	external
https://www.hitachi.co.jp/Prod/comp/soft1/global/…	external
https://www.hitachi.co.jp/Prod/comp/soft1/global/…	external
https://access.redhat.com/errata/RHSA-2022:7417	external
https://access.redhat.com/errata/RHSA-2022:7409	external
https://access.redhat.com/errata/RHSA-2022:7411	external
https://access.redhat.com/errata/RHSA-2022:7410	external
https://access.redhat.com/errata/RHSA-2022:7896	external
https://access.redhat.com/errata/RHSA-2022:8761	external
https://access.redhat.com/errata/RHSA-2023:0272	external
https://www.dell.com/support/kbdoc/000221770/dsa-2024-=	external
https://www.ibm.com/support/pages/node/7144861	external
https://access.redhat.com/errata/RHSA-2024:3061	external
https://access.redhat.com/errata/RHSA-2025:4226	external
https://access.redhat.com/errata/RHSA-2025:4437	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat Fuse ist eine Open-Source-Integrationsplattform, die auf Apache Camel basiert.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuf\u00fchren, einen Denial of Service Zustand herbeizuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0607 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0607.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0607 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0607"
      },
      {
        "category": "external",
        "summary": "RHSA-2022:5532 - Security Advisory vom 2022-07-07",
        "url": "https://access.redhat.com/errata/RHSA-2022:5532"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5596 vom 2022-07-20",
        "url": "https://access.redhat.com/errata/RHSA-2022:5596"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2022-125 vom 2022-07-28",
        "url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-125/index.html"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2022-124 vom 2022-07-28",
        "url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-124/index.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-5196 vom 2022-07-31",
        "url": "https://lists.debian.org/debian-security-announce/2022/msg00165.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5903 vom 2022-08-04",
        "url": "https://access.redhat.com/errata/RHSA-2022:5903"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6787 vom 2022-10-04",
        "url": "https://access.redhat.com/errata/RHSA-2022:6787"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6783 vom 2022-10-04",
        "url": "https://access.redhat.com/errata/RHSA-2022:6783"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6782 vom 2022-10-04",
        "url": "https://access.redhat.com/errata/RHSA-2022:6782"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6822 vom 2022-10-05",
        "url": "https://access.redhat.com/errata/RHSA-2022:6822"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6823 vom 2022-10-05",
        "url": "https://access.redhat.com/errata/RHSA-2022:6823"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6825 vom 2022-10-05",
        "url": "https://access.redhat.com/errata/RHSA-2022:6825"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6821 vom 2022-10-05",
        "url": "https://access.redhat.com/errata/RHSA-2022:6821"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6813 vom 2022-10-05",
        "url": "https://access.redhat.com/errata/RHSA-2022:6813"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6835 vom 2022-10-06",
        "url": "https://access.redhat.com/errata/RHSA-2022:6835"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20221014-0006 vom 2022-10-14",
        "url": "https://security.netapp.com/advisory/ntap-20221014-0006/"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6831855 vom 2022-10-26",
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulnerable-to-using-components-with-known-vulnerabilities-14/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7177 vom 2022-10-25",
        "url": "https://access.redhat.com/errata/RHSA-2022:7177"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7257 vom 2022-10-29",
        "url": "https://access.redhat.com/errata/RHSA-2022:7257"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2022-135 vom 2022-11-01",
        "url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-135/index.html"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2022-137 vom 2022-11-01",
        "url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-137/index.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7417 vom 2022-11-03",
        "url": "https://access.redhat.com/errata/RHSA-2022:7417"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7409 vom 2022-11-03",
        "url": "https://access.redhat.com/errata/RHSA-2022:7409"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7411 vom 2022-11-03",
        "url": "https://access.redhat.com/errata/RHSA-2022:7411"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7410 vom 2022-11-03",
        "url": "https://access.redhat.com/errata/RHSA-2022:7410"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7896 vom 2022-11-09",
        "url": "https://access.redhat.com/errata/RHSA-2022:7896"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:8761 vom 2022-12-14",
        "url": "https://access.redhat.com/errata/RHSA-2022:8761"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:0272 vom 2023-02-06",
        "url": "https://access.redhat.com/errata/RHSA-2023:0272"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2024-070 vom 2024-02-03",
        "url": "https://www.dell.com/support/kbdoc/000221770/dsa-2024-="
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7144861 vom 2024-03-20",
        "url": "https://www.ibm.com/support/pages/node/7144861"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3061 vom 2024-05-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:3061"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:4226 vom 2025-04-28",
        "url": "https://access.redhat.com/errata/RHSA-2025:4226"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:4437 vom 2025-05-05",
        "url": "https://access.redhat.com/errata/RHSA-2025:4437"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat FUSE: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-05-04T22:00:00.000+00:00",
      "generator": {
        "date": "2025-05-05T08:09:20.562+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.12"
        }
      },
      "id": "WID-SEC-W-2022-0607",
      "initial_release_date": "2022-07-07T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-07-07T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-07-19T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-07-28T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2022-07-31T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2022-08-03T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-10-04T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-10-05T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-10-06T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-10-16T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2022-10-25T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von IBM und Red Hat aufgenommen"
        },
        {
          "date": "2022-10-30T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-10-31T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2022-11-03T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-11-09T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-12-14T23:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-02-06T23:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-02-04T23:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-03-20T23:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-05-21T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-04-27T22:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-04-28T22:00:00.000+00:00",
          "number": "21",
          "summary": "Red Hat JBoss Enterprise Application Platform ist ebenfalls betrroffen"
        },
        {
          "date": "2025-05-04T22:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "22"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "EMC Avamar",
            "product": {
              "name": "EMC Avamar",
              "product_id": "T014381",
              "product_identification_helper": {
                "cpe": "cpe:/a:emc:avamar:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "EMC"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Hitachi Ops Center",
            "product": {
              "name": "Hitachi Ops Center",
              "product_id": "T017562",
              "product_identification_helper": {
                "cpe": "cpe:/a:hitachi:ops_center:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Hitachi"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.5",
                "product": {
                  "name": "IBM QRadar SIEM 7.5",
                  "product_id": "T022954",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:qradar_siem:7.5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.4",
                "product": {
                  "name": "IBM QRadar SIEM 7.4",
                  "product_id": "T024775",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:qradar_siem:7.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "QRadar SIEM"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Plus 10.1",
                "product": {
                  "name": "IBM Spectrum Protect Plus 10.1",
                  "product_id": "T015895",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect:plus_10.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spectrum Protect"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "NetApp ActiveIQ Unified Manager",
            "product": {
              "name": "NetApp ActiveIQ Unified Manager",
              "product_id": "658714",
              "product_identification_helper": {
                "cpe": "cpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "NetApp"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.11.0",
                "product": {
                  "name": "Red Hat FUSE \u003c7.11.0",
                  "product_id": "723344"
                }
              },
              {
                "category": "product_version",
                "name": "7.11.0",
                "product": {
                  "name": "Red Hat FUSE 7.11.0",
                  "product_id": "723344-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:fuse:6.0.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FUSE"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.1.10",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform \u003c7.1.10",
                  "product_id": "T043205"
                }
              },
              {
                "category": "product_version",
                "name": "7.1.10",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7.1.10",
                  "product_id": "T043205-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.3.13",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform \u003c7.3.13",
                  "product_id": "T043288"
                }
              },
              {
                "category": "product_version",
                "name": "7.3.13",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7.3.13",
                  "product_id": "T043288-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.3.13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-15250",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2020-15250"
    },
    {
      "cve": "CVE-2020-25689",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2020-25689"
    },
    {
      "cve": "CVE-2020-29582",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2020-29582"
    },
    {
      "cve": "CVE-2020-36518",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2020-36518"
    },
    {
      "cve": "CVE-2020-7020",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2020-7020"
    },
    {
      "cve": "CVE-2020-9484",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2020-9484"
    },
    {
      "cve": "CVE-2021-22060",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-22060"
    },
    {
      "cve": "CVE-2021-22096",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-22096"
    },
    {
      "cve": "CVE-2021-22119",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-22119"
    },
    {
      "cve": "CVE-2021-22569",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-22569"
    },
    {
      "cve": "CVE-2021-22573",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-22573"
    },
    {
      "cve": "CVE-2021-24122",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-24122"
    },
    {
      "cve": "CVE-2021-2471",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-2471"
    },
    {
      "cve": "CVE-2021-25122",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-25122"
    },
    {
      "cve": "CVE-2021-25329",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-25329"
    },
    {
      "cve": "CVE-2021-29505",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-29505"
    },
    {
      "cve": "CVE-2021-30640",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-30640"
    },
    {
      "cve": "CVE-2021-33037",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-33037"
    },
    {
      "cve": "CVE-2021-33813",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-33813"
    },
    {
      "cve": "CVE-2021-35515",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-35515"
    },
    {
      "cve": "CVE-2021-35516",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-35516"
    },
    {
      "cve": "CVE-2021-35517",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-35517"
    },
    {
      "cve": "CVE-2021-36090",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-36090"
    },
    {
      "cve": "CVE-2021-3629",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-3629"
    },
    {
      "cve": "CVE-2021-3642",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-3642"
    },
    {
      "cve": "CVE-2021-3644",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-3644"
    },
    {
      "cve": "CVE-2021-3807",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-3807"
    },
    {
      "cve": "CVE-2021-38153",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-38153"
    },
    {
      "cve": "CVE-2021-3859",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-3859"
    },
    {
      "cve": "CVE-2021-40690",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-40690"
    },
    {
      "cve": "CVE-2021-41079",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-41079"
    },
    {
      "cve": "CVE-2021-41766",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-41766"
    },
    {
      "cve": "CVE-2021-4178",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-4178"
    },
    {
      "cve": "CVE-2021-42340",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-42340"
    },
    {
      "cve": "CVE-2021-42550",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-42550"
    },
    {
      "cve": "CVE-2021-43797",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-43797"
    },
    {
      "cve": "CVE-2021-43859",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-43859"
    },
    {
      "cve": "CVE-2022-0084",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-0084"
    },
    {
      "cve": "CVE-2022-1259",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-1259"
    },
    {
      "cve": "CVE-2022-1319",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-1319"
    },
    {
      "cve": "CVE-2022-21363",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-21363"
    },
    {
      "cve": "CVE-2022-21724",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-21724"
    },
    {
      "cve": "CVE-2022-22932",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-22932"
    },
    {
      "cve": "CVE-2022-22950",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-22950"
    },
    {
      "cve": "CVE-2022-22968",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-22968"
    },
    {
      "cve": "CVE-2022-22970",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-22970"
    },
    {
      "cve": "CVE-2022-22971",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-22971"
    },
    {
      "cve": "CVE-2022-22976",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-22976"
    },
    {
      "cve": "CVE-2022-22978",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-22978"
    },
    {
      "cve": "CVE-2022-23181",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-23181"
    },
    {
      "cve": "CVE-2022-23221",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-23221"
    },
    {
      "cve": "CVE-2022-23596",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-23596"
    },
    {
      "cve": "CVE-2022-23913",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-23913"
    },
    {
      "cve": "CVE-2022-24614",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-24614"
    },
    {
      "cve": "CVE-2022-25845",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-25845"
    },
    {
      "cve": "CVE-2022-26336",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-26336"
    },
    {
      "cve": "CVE-2022-26520",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-26520"
    },
    {
      "cve": "CVE-2022-30126",
      "product_status": {
        "known_affected": [
          "T022954",
          "T014381",
          "2951",
          "T043205",
          "67646",
          "723344",
          "T024775",
          "658714",
          "T015895",
          "T017562",
          "T043288"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2022-30126"
    }
  ]
}

CVE-2020-15250 (GCVE-0-2020-15250)

Vulnerability from cvelistv5 – Published: 2020-10-12 17:55 – Updated: 2024-08-04 13:08

Title

Information disclosure in JUnit4

Summary

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

39 references

URL	Tags
https://github.com/junit-team/junit4/security/adv…	x_refsource_CONFIRM
https://github.com/junit-team/junit4/commit/61015…	x_refsource_MISC
https://github.com/junit-team/junit4/blob/7852b90…	x_refsource_MISC
https://junit.org/junit4/javadoc/4.13/org/junit/r…	x_refsource_MISC
https://lists.apache.org/thread.html/r5f884150757…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rbaec90e699b…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r71787702848…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rb2771949c67…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rde385b8b53e…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rc49cf1547ef…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r500517c2320…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r95f8ef60c4b…	mailing-listx_refsource_MLIST
https://github.com/junit-team/junit4/issues/1676	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/ra1bdb9efae8…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rb33212dab7b…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/raebf13f53cd…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r01110833b63…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rde8e70b95c9…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rdef7d1380c8…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rdbdd30510a7…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rea812d8612f…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rf797d119cc3…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/reb700e60b96…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rf2ec93f4ca9…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r30f502d2f79…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r925eaae7dd8…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r29d703d1986…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r09cfbb5aedd…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r2b78f23bc27…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rf6e5d894d4b…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r687f489b10b…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r934208a520b…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r8b02dc6f18d…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r9710067c709…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r1209986f793…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r742b44fd752…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rb2ffe2993f4…	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
junit-team	junit4	Affected: < 4.13.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:23.218Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/junit-team/junit4/commit/610155b8c22138329f0723eec22521627dbc52ae"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/junit-team/junit4/blob/7852b90cfe1cea1e0cdaa19d490c83f0d8684b50/doc/ReleaseNotes4.13.1.md"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://junit.org/junit4/javadoc/4.13/org/junit/rules/TemporaryFolder.html"
          },
          {
            "name": "[creadur-dev] 20201013 [jira] [Created] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r5f8841507576f595bb783ccec6a7cb285ea90d4e6f5043eae0e61a41%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20201014 [jira] [Commented] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbaec90e699bc7c7bd9a053f76707a36fda48b6d558f31dc79147dbf9%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-commits] 20201014 [creadur-whisker] branch master updated: Update junit to fix CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r717877028482c55acf604d7a0106af4ca05da4208c708fb157b53672%40%3Ccommits.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20201014 [jira] [Assigned] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb2771949c676ca984e58a5cd5ca79c2634dee1945e0406e48e0f8457%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-commits] 20201014 [creadur-tentacles] branch master updated: Update junit to fix CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rde385b8b53ed046600ef68dd6b4528dea7566aaddb02c3e702cc28bc%40%3Ccommits.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20201014 [jira] [Updated] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc49cf1547ef6cac1be4b3c92339b2cae0acacf5acaba13cfa429a872%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-dev] 20201014 [jira] [Closed] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r500517c23200fb2fdb0b82770a62dd6c88b3521cfb01cfd0c76e3f8b%40%3Cdev.creadur.apache.org%3E"
          },
          {
            "name": "[creadur-commits] 20201014 [creadur-rat] 01/02: RAT-277: Update junit to fix CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r95f8ef60c4b3a5284b647bb3132cda08e6fadad888a66b84f49da0b0%40%3Ccommits.creadur.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/junit-team/junit4/issues/1676"
          },
          {
            "name": "[debian-lts-announce] 20201101 [SECURITY] [DLA 2426-1] junit4 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00003.html"
          },
          {
            "name": "[pdfbox-dev] 20201115 ossindex-maven-plugin and build issue",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra1bdb9efae84794e8ffa2f8474be8290ba57830eefe9714b95da714b%40%3Cdev.pdfbox.apache.org%3E"
          },
          {
            "name": "[turbine-commits] 20210203 svn commit: r1886168 - in /turbine/core/trunk: ./ conf/ conf/test/ src/java/org/apache/turbine/services/urlmapper/ src/test/org/apache/turbine/services/urlmapper/ src/test/org/apache/turbine/services/urlmapper/model/ xdocs/howto/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E"
          },
          {
            "name": "[pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/raebf13f53cd5d23d990712e3d11c80da9a7bae94a6284050f148ed99%40%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-commits] 20210413 [GitHub] [pulsar] lhotari removed a comment on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r01110833b63616ddbef59ae4e10c0fbd0060f0a51206defd4cb4d917%40%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-commits] 20210413 [GitHub] [pulsar] lhotari commented on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rde8e70b95c992378e8570e4df400c6008a9839eabdfb8f800a3e5af6%40%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-commits] 20210414 [GitHub] [pulsar] lhotari commented on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdef7d1380c86e7c0edf8a0f89a2a8db86fce5e363457d56b722691b4%40%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-commits] 20210414 [GitHub] [pulsar] lhotari removed a comment on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdbdd30510a7c4d0908fd22075c02b75bbc2e0d977ec22249ef3133cb%40%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-commits] 20210415 [GitHub] [pulsar] lhotari removed a comment on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rea812d8612fdc46842a2a57248cad4b01ddfdb1e9b037c49e68fdbfb%40%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-commits] 20210415 [GitHub] [pulsar] lhotari commented on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf797d119cc3f51a8d7c3c5cbe50cb4524c8487282b986edde83a9467%40%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-commits] 20210415 [GitHub] [pulsar] eolivelli merged pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/reb700e60b9642eafa4b7922bfee80796394135aa09c7a239ef9f7486%40%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-commits] 20210415 [pulsar] branch master updated: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak (#10147)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf2ec93f4ca9a97d1958eb4a31b1830f723419ce9bf2018a6e5741d5b%40%3Ccommits.pulsar.apache.org%3E"
          },
          {
            "name": "[creadur-commits] 20210621 [creadur-rat] 02/13: RAT-277: Update junit to fix CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r30f502d2f79e8d635361adb8108dcbb73095163fcbd776ee7984a094%40%3Ccommits.creadur.apache.org%3E"
          },
          {
            "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-790) Upgrade to JUnit 4.13.1 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r925eaae7dd8f77dd61eefc49c1fcf54bd9ecfe605486870d7b1e9390%40%3Cpluto-dev.portals.apache.org%3E"
          },
          {
            "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-790 Upgrade to JUnit 4.13.1 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r29d703d1986d9b871466ff24082a1828ac8ad27bb0965a93a383872e%40%3Cpluto-scm.portals.apache.org%3E"
          },
          {
            "name": "[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-790) Upgrade to JUnit 4.13.1 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r09cfbb5aedd76023691bbce9ca4ce2e16bb07dd37554a17efc19935d%40%3Cpluto-dev.portals.apache.org%3E"
          },
          {
            "name": "[knox-dev] 20211004 [jira] [Created] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r2b78f23bc2711a76a7fc73ad67b7fcd6817c5cfccefd6f30a4f54943%40%3Cdev.knox.apache.org%3E"
          },
          {
            "name": "[knox-dev] 20211004 [GitHub] [knox] zeroflag opened a new pull request #505: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf6e5d894d4b03bef537c9d6641272e0197c047c0d1982b4e176d0353%40%3Cdev.knox.apache.org%3E"
          },
          {
            "name": "[knox-dev] 20211004 [jira] [Work logged] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r687f489b10b0d14e46f626aa88476545e1a2600b24c4ebd3c0d2a10b%40%3Cdev.knox.apache.org%3E"
          },
          {
            "name": "[knox-dev] 20211004 [GitHub] [knox] zeroflag commented on pull request #505: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r934208a520b38f5cf0cae199b6b076bfe7d081809528b0eff2459e40%40%3Cdev.knox.apache.org%3E"
          },
          {
            "name": "[knox-dev] 20211008 [jira] [Commented] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8b02dc6f18df11ff39eedb3038f1e31e6f90a779b1959bae65107279%40%3Cdev.knox.apache.org%3E"
          },
          {
            "name": "[knox-commits] 20211008 [knox] branch master updated: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250 (#505)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9710067c7096b83cb6ae8f53a2f6f94e9c042d1bf1d6929f8f2a2b7a%40%3Ccommits.knox.apache.org%3E"
          },
          {
            "name": "[knox-dev] 20211008 [jira] [Resolved] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1209986f79359b518d09513ff05a88e5b3c398540e775edea76a4774%40%3Cdev.knox.apache.org%3E"
          },
          {
            "name": "[knox-dev] 20211008 [jira] [Work logged] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r742b44fd75215fc75963b8ecc22b2e4372e68d67d3d859d2b5e8743f%40%3Cdev.knox.apache.org%3E"
          },
          {
            "name": "[knox-dev] 20211008 [GitHub] [knox] smolnar82 merged pull request #505: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb2ffe2993f4dccc48d832e1a0f1c419477781b6ea16e725ca2276dbb%40%3Cdev.knox.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "junit4",
          "vendor": "junit-team",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.13.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system\u0027s temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-19T23:21:38.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/junit-team/junit4/commit/610155b8c22138329f0723eec22521627dbc52ae"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/junit-team/junit4/blob/7852b90cfe1cea1e0cdaa19d490c83f0d8684b50/doc/ReleaseNotes4.13.1.md"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://junit.org/junit4/javadoc/4.13/org/junit/rules/TemporaryFolder.html"
        },
        {
          "name": "[creadur-dev] 20201013 [jira] [Created] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r5f8841507576f595bb783ccec6a7cb285ea90d4e6f5043eae0e61a41%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20201014 [jira] [Commented] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rbaec90e699bc7c7bd9a053f76707a36fda48b6d558f31dc79147dbf9%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-commits] 20201014 [creadur-whisker] branch master updated: Update junit to fix CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r717877028482c55acf604d7a0106af4ca05da4208c708fb157b53672%40%3Ccommits.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20201014 [jira] [Assigned] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb2771949c676ca984e58a5cd5ca79c2634dee1945e0406e48e0f8457%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-commits] 20201014 [creadur-tentacles] branch master updated: Update junit to fix CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rde385b8b53ed046600ef68dd6b4528dea7566aaddb02c3e702cc28bc%40%3Ccommits.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20201014 [jira] [Updated] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc49cf1547ef6cac1be4b3c92339b2cae0acacf5acaba13cfa429a872%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-dev] 20201014 [jira] [Closed] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r500517c23200fb2fdb0b82770a62dd6c88b3521cfb01cfd0c76e3f8b%40%3Cdev.creadur.apache.org%3E"
        },
        {
          "name": "[creadur-commits] 20201014 [creadur-rat] 01/02: RAT-277: Update junit to fix CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r95f8ef60c4b3a5284b647bb3132cda08e6fadad888a66b84f49da0b0%40%3Ccommits.creadur.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/junit-team/junit4/issues/1676"
        },
        {
          "name": "[debian-lts-announce] 20201101 [SECURITY] [DLA 2426-1] junit4 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00003.html"
        },
        {
          "name": "[pdfbox-dev] 20201115 ossindex-maven-plugin and build issue",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra1bdb9efae84794e8ffa2f8474be8290ba57830eefe9714b95da714b%40%3Cdev.pdfbox.apache.org%3E"
        },
        {
          "name": "[turbine-commits] 20210203 svn commit: r1886168 - in /turbine/core/trunk: ./ conf/ conf/test/ src/java/org/apache/turbine/services/urlmapper/ src/test/org/apache/turbine/services/urlmapper/ src/test/org/apache/turbine/services/urlmapper/model/ xdocs/howto/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E"
        },
        {
          "name": "[pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/raebf13f53cd5d23d990712e3d11c80da9a7bae94a6284050f148ed99%40%3Ccommits.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-commits] 20210413 [GitHub] [pulsar] lhotari removed a comment on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r01110833b63616ddbef59ae4e10c0fbd0060f0a51206defd4cb4d917%40%3Ccommits.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-commits] 20210413 [GitHub] [pulsar] lhotari commented on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rde8e70b95c992378e8570e4df400c6008a9839eabdfb8f800a3e5af6%40%3Ccommits.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-commits] 20210414 [GitHub] [pulsar] lhotari commented on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdef7d1380c86e7c0edf8a0f89a2a8db86fce5e363457d56b722691b4%40%3Ccommits.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-commits] 20210414 [GitHub] [pulsar] lhotari removed a comment on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdbdd30510a7c4d0908fd22075c02b75bbc2e0d977ec22249ef3133cb%40%3Ccommits.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-commits] 20210415 [GitHub] [pulsar] lhotari removed a comment on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rea812d8612fdc46842a2a57248cad4b01ddfdb1e9b037c49e68fdbfb%40%3Ccommits.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-commits] 20210415 [GitHub] [pulsar] lhotari commented on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf797d119cc3f51a8d7c3c5cbe50cb4524c8487282b986edde83a9467%40%3Ccommits.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-commits] 20210415 [GitHub] [pulsar] eolivelli merged pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/reb700e60b9642eafa4b7922bfee80796394135aa09c7a239ef9f7486%40%3Ccommits.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-commits] 20210415 [pulsar] branch master updated: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak (#10147)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf2ec93f4ca9a97d1958eb4a31b1830f723419ce9bf2018a6e5741d5b%40%3Ccommits.pulsar.apache.org%3E"
        },
        {
          "name": "[creadur-commits] 20210621 [creadur-rat] 02/13: RAT-277: Update junit to fix CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r30f502d2f79e8d635361adb8108dcbb73095163fcbd776ee7984a094%40%3Ccommits.creadur.apache.org%3E"
        },
        {
          "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-790) Upgrade to JUnit 4.13.1 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r925eaae7dd8f77dd61eefc49c1fcf54bd9ecfe605486870d7b1e9390%40%3Cpluto-dev.portals.apache.org%3E"
        },
        {
          "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-790 Upgrade to JUnit 4.13.1 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r29d703d1986d9b871466ff24082a1828ac8ad27bb0965a93a383872e%40%3Cpluto-scm.portals.apache.org%3E"
        },
        {
          "name": "[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-790) Upgrade to JUnit 4.13.1 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r09cfbb5aedd76023691bbce9ca4ce2e16bb07dd37554a17efc19935d%40%3Cpluto-dev.portals.apache.org%3E"
        },
        {
          "name": "[knox-dev] 20211004 [jira] [Created] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r2b78f23bc2711a76a7fc73ad67b7fcd6817c5cfccefd6f30a4f54943%40%3Cdev.knox.apache.org%3E"
        },
        {
          "name": "[knox-dev] 20211004 [GitHub] [knox] zeroflag opened a new pull request #505: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf6e5d894d4b03bef537c9d6641272e0197c047c0d1982b4e176d0353%40%3Cdev.knox.apache.org%3E"
        },
        {
          "name": "[knox-dev] 20211004 [jira] [Work logged] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r687f489b10b0d14e46f626aa88476545e1a2600b24c4ebd3c0d2a10b%40%3Cdev.knox.apache.org%3E"
        },
        {
          "name": "[knox-dev] 20211004 [GitHub] [knox] zeroflag commented on pull request #505: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r934208a520b38f5cf0cae199b6b076bfe7d081809528b0eff2459e40%40%3Cdev.knox.apache.org%3E"
        },
        {
          "name": "[knox-dev] 20211008 [jira] [Commented] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r8b02dc6f18df11ff39eedb3038f1e31e6f90a779b1959bae65107279%40%3Cdev.knox.apache.org%3E"
        },
        {
          "name": "[knox-commits] 20211008 [knox] branch master updated: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250 (#505)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r9710067c7096b83cb6ae8f53a2f6f94e9c042d1bf1d6929f8f2a2b7a%40%3Ccommits.knox.apache.org%3E"
        },
        {
          "name": "[knox-dev] 20211008 [jira] [Resolved] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1209986f79359b518d09513ff05a88e5b3c398540e775edea76a4774%40%3Cdev.knox.apache.org%3E"
        },
        {
          "name": "[knox-dev] 20211008 [jira] [Work logged] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r742b44fd75215fc75963b8ecc22b2e4372e68d67d3d859d2b5e8743f%40%3Cdev.knox.apache.org%3E"
        },
        {
          "name": "[knox-dev] 20211008 [GitHub] [knox] smolnar82 merged pull request #505: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb2ffe2993f4dccc48d832e1a0f1c419477781b6ea16e725ca2276dbb%40%3Cdev.knox.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        }
      ],
      "source": {
        "advisory": "GHSA-269g-pwp5-87pp",
        "discovery": "UNKNOWN"
      },
      "title": "Information disclosure in JUnit4",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15250",
          "STATE": "PUBLIC",
          "TITLE": "Information disclosure in JUnit4"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "junit4",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 4.13.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "junit-team"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system\u0027s temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp",
              "refsource": "CONFIRM",
              "url": "https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp"
            },
            {
              "name": "https://github.com/junit-team/junit4/commit/610155b8c22138329f0723eec22521627dbc52ae",
              "refsource": "MISC",
              "url": "https://github.com/junit-team/junit4/commit/610155b8c22138329f0723eec22521627dbc52ae"
            },
            {
              "name": "https://github.com/junit-team/junit4/blob/7852b90cfe1cea1e0cdaa19d490c83f0d8684b50/doc/ReleaseNotes4.13.1.md",
              "refsource": "MISC",
              "url": "https://github.com/junit-team/junit4/blob/7852b90cfe1cea1e0cdaa19d490c83f0d8684b50/doc/ReleaseNotes4.13.1.md"
            },
            {
              "name": "https://junit.org/junit4/javadoc/4.13/org/junit/rules/TemporaryFolder.html",
              "refsource": "MISC",
              "url": "https://junit.org/junit4/javadoc/4.13/org/junit/rules/TemporaryFolder.html"
            },
            {
              "name": "[creadur-dev] 20201013 [jira] [Created] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r5f8841507576f595bb783ccec6a7cb285ea90d4e6f5043eae0e61a41@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20201014 [jira] [Commented] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rbaec90e699bc7c7bd9a053f76707a36fda48b6d558f31dc79147dbf9@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-commits] 20201014 [creadur-whisker] branch master updated: Update junit to fix CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r717877028482c55acf604d7a0106af4ca05da4208c708fb157b53672@%3Ccommits.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20201014 [jira] [Assigned] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb2771949c676ca984e58a5cd5ca79c2634dee1945e0406e48e0f8457@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-commits] 20201014 [creadur-tentacles] branch master updated: Update junit to fix CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rde385b8b53ed046600ef68dd6b4528dea7566aaddb02c3e702cc28bc@%3Ccommits.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20201014 [jira] [Updated] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rc49cf1547ef6cac1be4b3c92339b2cae0acacf5acaba13cfa429a872@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-dev] 20201014 [jira] [Closed] (RAT-277) Update junit in all Creadur projects in order to fix CVE-2020-15250 (Low severity)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r500517c23200fb2fdb0b82770a62dd6c88b3521cfb01cfd0c76e3f8b@%3Cdev.creadur.apache.org%3E"
            },
            {
              "name": "[creadur-commits] 20201014 [creadur-rat] 01/02: RAT-277: Update junit to fix CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r95f8ef60c4b3a5284b647bb3132cda08e6fadad888a66b84f49da0b0@%3Ccommits.creadur.apache.org%3E"
            },
            {
              "name": "https://github.com/junit-team/junit4/issues/1676",
              "refsource": "MISC",
              "url": "https://github.com/junit-team/junit4/issues/1676"
            },
            {
              "name": "[debian-lts-announce] 20201101 [SECURITY] [DLA 2426-1] junit4 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00003.html"
            },
            {
              "name": "[pdfbox-dev] 20201115 ossindex-maven-plugin and build issue",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra1bdb9efae84794e8ffa2f8474be8290ba57830eefe9714b95da714b@%3Cdev.pdfbox.apache.org%3E"
            },
            {
              "name": "[turbine-commits] 20210203 svn commit: r1886168 - in /turbine/core/trunk: ./ conf/ conf/test/ src/java/org/apache/turbine/services/urlmapper/ src/test/org/apache/turbine/services/urlmapper/ src/test/org/apache/turbine/services/urlmapper/model/ xdocs/howto/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E"
            },
            {
              "name": "[pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/raebf13f53cd5d23d990712e3d11c80da9a7bae94a6284050f148ed99@%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-commits] 20210413 [GitHub] [pulsar] lhotari removed a comment on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r01110833b63616ddbef59ae4e10c0fbd0060f0a51206defd4cb4d917@%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-commits] 20210413 [GitHub] [pulsar] lhotari commented on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rde8e70b95c992378e8570e4df400c6008a9839eabdfb8f800a3e5af6@%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-commits] 20210414 [GitHub] [pulsar] lhotari commented on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdef7d1380c86e7c0edf8a0f89a2a8db86fce5e363457d56b722691b4@%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-commits] 20210414 [GitHub] [pulsar] lhotari removed a comment on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdbdd30510a7c4d0908fd22075c02b75bbc2e0d977ec22249ef3133cb@%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-commits] 20210415 [GitHub] [pulsar] lhotari removed a comment on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rea812d8612fdc46842a2a57248cad4b01ddfdb1e9b037c49e68fdbfb@%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-commits] 20210415 [GitHub] [pulsar] lhotari commented on pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf797d119cc3f51a8d7c3c5cbe50cb4524c8487282b986edde83a9467@%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-commits] 20210415 [GitHub] [pulsar] eolivelli merged pull request #10147: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/reb700e60b9642eafa4b7922bfee80796394135aa09c7a239ef9f7486@%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-commits] 20210415 [pulsar] branch master updated: [Security] Upgrade junit version to 4.13.1 to resolve CVE-2020-15250 and fix test dependency leak (#10147)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf2ec93f4ca9a97d1958eb4a31b1830f723419ce9bf2018a6e5741d5b@%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "name": "[creadur-commits] 20210621 [creadur-rat] 02/13: RAT-277: Update junit to fix CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r30f502d2f79e8d635361adb8108dcbb73095163fcbd776ee7984a094@%3Ccommits.creadur.apache.org%3E"
            },
            {
              "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-790) Upgrade to JUnit 4.13.1 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r925eaae7dd8f77dd61eefc49c1fcf54bd9ecfe605486870d7b1e9390@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
              "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-790 Upgrade to JUnit 4.13.1 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r29d703d1986d9b871466ff24082a1828ac8ad27bb0965a93a383872e@%3Cpluto-scm.portals.apache.org%3E"
            },
            {
              "name": "[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-790) Upgrade to JUnit 4.13.1 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r09cfbb5aedd76023691bbce9ca4ce2e16bb07dd37554a17efc19935d@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
              "name": "[knox-dev] 20211004 [jira] [Created] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r2b78f23bc2711a76a7fc73ad67b7fcd6817c5cfccefd6f30a4f54943@%3Cdev.knox.apache.org%3E"
            },
            {
              "name": "[knox-dev] 20211004 [GitHub] [knox] zeroflag opened a new pull request #505: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf6e5d894d4b03bef537c9d6641272e0197c047c0d1982b4e176d0353@%3Cdev.knox.apache.org%3E"
            },
            {
              "name": "[knox-dev] 20211004 [jira] [Work logged] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r687f489b10b0d14e46f626aa88476545e1a2600b24c4ebd3c0d2a10b@%3Cdev.knox.apache.org%3E"
            },
            {
              "name": "[knox-dev] 20211004 [GitHub] [knox] zeroflag commented on pull request #505: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r934208a520b38f5cf0cae199b6b076bfe7d081809528b0eff2459e40@%3Cdev.knox.apache.org%3E"
            },
            {
              "name": "[knox-dev] 20211008 [jira] [Commented] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r8b02dc6f18df11ff39eedb3038f1e31e6f90a779b1959bae65107279@%3Cdev.knox.apache.org%3E"
            },
            {
              "name": "[knox-commits] 20211008 [knox] branch master updated: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250 (#505)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r9710067c7096b83cb6ae8f53a2f6f94e9c042d1bf1d6929f8f2a2b7a@%3Ccommits.knox.apache.org%3E"
            },
            {
              "name": "[knox-dev] 20211008 [jira] [Resolved] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1209986f79359b518d09513ff05a88e5b3c398540e775edea76a4774@%3Cdev.knox.apache.org%3E"
            },
            {
              "name": "[knox-dev] 20211008 [jira] [Work logged] (KNOX-2674) Upgrade junit to 4.13.2 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r742b44fd75215fc75963b8ecc22b2e4372e68d67d3d859d2b5e8743f@%3Cdev.knox.apache.org%3E"
            },
            {
              "name": "[knox-dev] 20211008 [GitHub] [knox] smolnar82 merged pull request #505: KNOX-2674 - Upgrade junit to 4.13.2 due to CVE-2020-15250",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb2ffe2993f4dccc48d832e1a0f1c419477781b6ea16e725ca2276dbb@%3Cdev.knox.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-269g-pwp5-87pp",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15250",
    "datePublished": "2020-10-12T17:55:13.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:23.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25689 (GCVE-0-2020-25689)

Vulnerability from cvelistv5 – Published: 2020-10-30 00:00 – Updated: 2024-08-04 15:40

Summary

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-401

Assigner

redhat

References

2 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…
https://security.netapp.com/advisory/ntap-2020112…

Impacted products

1 product

Vendor	Product	Version
Red Hat	wildfly-core	Affected: up to 21.0.0.Final

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:36.775Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201123-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wildfly-core",
          "vendor": "Red Hat",
          "versions": [
            {
              "status": "affected",
              "version": "up to 21.0.0.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-07T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20201123-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-25689",
    "datePublished": "2020-10-30T00:00:00.000Z",
    "dateReserved": "2020-09-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:40:36.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-29582 (GCVE-0-2020-29582)

Vulnerability from cvelistv5 – Published: 2021-02-03 15:20 – Updated: 2024-08-04 16:55

Summary

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

6 references

URL	Tags
https://blog.jetbrains.com	x_refsource_MISC
https://lists.apache.org/thread.html/r2721aba31a8…	mailing-listx_refsource_MLIST
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
https://blog.jetbrains.com/blog/2021/02/03/jetbra…	x_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:55:10.292Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.jetbrains.com"
          },
          {
            "name": "[kafka-users] 20210617 vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-19T23:22:41.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.jetbrains.com"
        },
        {
          "name": "[kafka-users] 20210617 vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-29582",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blog.jetbrains.com",
              "refsource": "MISC",
              "url": "https://blog.jetbrains.com"
            },
            {
              "name": "[kafka-users] 20210617 vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/",
              "refsource": "MISC",
              "url": "https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-29582",
    "datePublished": "2021-02-03T15:20:28.000Z",
    "dateReserved": "2020-12-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:55:10.292Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-36518 (GCVE-0-2020-36518)

Vulnerability from cvelistv5 – Published: 2022-03-11 00:00 – Updated: 2025-08-27 20:34

Summary

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

Assigner

mitre

References

7 references

URL	Tags
https://github.com/FasterXML/jackson-databind/iss…
https://www.oracle.com/security-alerts/cpuapr2022.html
https://lists.debian.org/debian-lts-announce/2022…	mailing-list
https://www.oracle.com/security-alerts/cpujul2022.html
https://security.netapp.com/advisory/ntap-2022050…
https://www.debian.org/security/2022/dsa-5283	vendor-advisory
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:30:08.127Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2816"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "name": "[debian-lts-announce] 20220502 [SECURITY] [DLA 2990-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220506-0004/"
          },
          {
            "name": "DSA-5283",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5283"
          },
          {
            "name": "[debian-lts-announce] 20221127 [SECURITY] [DLA 3207-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-36518",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-27T20:34:26.384595Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-27T20:34:32.190Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-27T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/FasterXML/jackson-databind/issues/2816"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "name": "[debian-lts-announce] 20220502 [SECURITY] [DLA 2990-1] jackson-databind security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20220506-0004/"
        },
        {
          "name": "DSA-5283",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5283"
        },
        {
          "name": "[debian-lts-announce] 20221127 [SECURITY] [DLA 3207-1] jackson-databind security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-36518",
    "datePublished": "2022-03-11T00:00:00.000Z",
    "dateReserved": "2022-03-11T00:00:00.000Z",
    "dateUpdated": "2025-08-27T20:34:32.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-7020 (GCVE-0-2020-7020)

Vulnerability from cvelistv5 – Published: 2020-10-22 16:30 – Updated: 2024-08-04 09:18

Summary

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Severity

No CVSS data available.

CWE

CWE-270 - Privilege Context Switching Error

Assigner

elastic

References

3 references

URL	Tags
https://staging-website.elastic.co/community/security/	x_refsource_MISC
https://discuss.elastic.co/t/elastic-stack-7-9-3-…	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2020112…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Elastic	Elasticsearch	Affected: before 6.8.13 and 7.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:18:02.985Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://staging-website.elastic.co/community/security/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201123-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Elasticsearch",
          "vendor": "Elastic",
          "versions": [
            {
              "status": "affected",
              "version": "before 6.8.13 and 7.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-270",
              "description": "CWE-270: Privilege Context Switching Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-23T11:06:12.000Z",
        "orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
        "shortName": "elastic"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://staging-website.elastic.co/community/security/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201123-0001/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@elastic.co",
          "ID": "CVE-2020-7020",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Elasticsearch",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 6.8.13 and 7.9.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Elastic"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-270: Privilege Context Switching Error"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://staging-website.elastic.co/community/security/",
              "refsource": "MISC",
              "url": "https://staging-website.elastic.co/community/security/"
            },
            {
              "name": "https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033",
              "refsource": "MISC",
              "url": "https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201123-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201123-0001/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
    "assignerShortName": "elastic",
    "cveId": "CVE-2020-7020",
    "datePublished": "2020-10-22T16:30:15.000Z",
    "dateReserved": "2020-01-14T00:00:00.000Z",
    "dateUpdated": "2024-08-04T09:18:02.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-9484 (GCVE-0-2020-9484)

Vulnerability from cvelistv5 – Published: 2020-05-20 18:26 – Updated: 2024-08-04 10:26

Summary

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Severity

No CVSS data available.

CWE

Remote Code Execution

Assigner

apache

References

42 references

URL	Tags
https://lists.apache.org/thread.html/rf70f53af27e…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r26950738f4b…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://lists.apache.org/thread.html/r7bc247fffcb…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
http://seclists.org/fulldisclosure/2020/Jun/6	mailing-listx_refsource_FULLDISC
https://security.gentoo.org/glsa/202006-21	vendor-advisoryx_refsource_GENTOO
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.apache.org/thread.html/rb1c0fb105ce…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
https://lists.apache.org/thread.html/r77eae567ed8…	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2020052…	x_refsource_CONFIRM
http://packetstormsecurity.com/files/157924/Apach…	x_refsource_MISC
https://www.debian.org/security/2020/dsa-4727	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/4448-1/	vendor-advisoryx_refsource_UBUNTU
https://lists.apache.org/thread.html/r123b3ebe389…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/raa4123e4721…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rc8473b08abd…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rf59c72572b9…	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
https://kc.mcafee.com/corporate/index?page=conten…	x_refsource_CONFIRM
https://usn.ubuntu.com/4596-1/	vendor-advisoryx_refsource_UBUNTU
https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
https://lists.apache.org/thread.html/rfe62fbf9d4c…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rfe62fbf9d4c…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rfe62fbf9d4c…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rf6d5d57b114…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rfe62fbf9d4c…	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/03/01/2	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r8dd19c514fa…	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://lists.apache.org/thread.html/r8a2ac0e476d…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rb51ccd58b21…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r11ce01e8a4c…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rc1778b38e74…	mailing-listx_refsource_MLIST
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Apache Tomcat	Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, 7.0.0 to 7.0.103

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:26:16.293Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[tomcat-users] 20200521 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[debian-lts-announce] 20200523 [SECURITY] [DLA 2217-1] tomcat7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00020.html"
          },
          {
            "name": "[tomcat-users] 20200524 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "openSUSE-SU-2020:0711",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html"
          },
          {
            "name": "[tomcat-dev] 20200527 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html"
          },
          {
            "name": "20200602 [CVE-2020-9484] Apache Tomcat RCE via PersistentManager",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2020/Jun/6"
          },
          {
            "name": "GLSA-202006-21",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-21"
          },
          {
            "name": "FEDORA-2020-ce396e7d5c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/"
          },
          {
            "name": "FEDORA-2020-d9169235a8",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/"
          },
          {
            "name": "[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[debian-lts-announce] 20200712 [SECURITY] [DLA 2279-1] tomcat8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200528-0005/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html"
          },
          {
            "name": "DSA-4727",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4727"
          },
          {
            "name": "USN-4448-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4448-1/"
          },
          {
            "name": "[tomee-commits] 20201013 [jira] [Created] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r123b3ebe389f46f9d337923f393cdae4d3e9b78d982d706712f0898c%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "name": "[tomee-commits] 20201013 [jira] [Updated] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/raa4123e472175bb052fbba165d37187cea923f755e8f3f30d124cb3f%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "name": "[tomee-commits] 20201013 [jira] [Assigned] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc8473b08abdf3c16494ed817bec1717a0ee0c8080315bc27db5f21c3%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "name": "[tomee-commits] 20201013 [jira] [Commented] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf59c72572b9fee674a5d5cc6afeca4ffc3918a02c354a81cc50b7119%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
          },
          {
            "name": "USN-4596-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4596-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "name": "[tomcat-dev] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210301 CVE-2021-25329: Apache Tomcat Incomplete fix for CVE-2020-9484",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/01/2"
          },
          {
            "name": "[tomee-commits] 20210522 [jira] [Closed] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8dd19c514face6dd85fd4eab0271854883f40c7307926c1f7cd5400c%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "name": "[tomcat-users] 20210701 What is \"h2c\"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20210701 Re: What is \"h2c\"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20210702 Re: CVE-2021-25329, was Re: Most recent security-related update to 8.5",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20210712 svn commit: r1891484 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc1778b38e74b5b6142414d57623bd55b023a72361f422836782fca3c%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Tomcat",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Apache Tomcat 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, 7.0.0 to 7.0.103"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:24:10.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "[tomcat-users] 20200521 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[debian-lts-announce] 20200523 [SECURITY] [DLA 2217-1] tomcat7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00020.html"
        },
        {
          "name": "[tomcat-users] 20200524 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "openSUSE-SU-2020:0711",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html"
        },
        {
          "name": "[tomcat-dev] 20200527 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html"
        },
        {
          "name": "20200602 [CVE-2020-9484] Apache Tomcat RCE via PersistentManager",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2020/Jun/6"
        },
        {
          "name": "GLSA-202006-21",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-21"
        },
        {
          "name": "FEDORA-2020-ce396e7d5c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/"
        },
        {
          "name": "FEDORA-2020-d9169235a8",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/"
        },
        {
          "name": "[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[debian-lts-announce] 20200712 [SECURITY] [DLA 2279-1] tomcat8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200528-0005/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html"
        },
        {
          "name": "DSA-4727",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4727"
        },
        {
          "name": "USN-4448-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4448-1/"
        },
        {
          "name": "[tomee-commits] 20201013 [jira] [Created] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r123b3ebe389f46f9d337923f393cdae4d3e9b78d982d706712f0898c%40%3Ccommits.tomee.apache.org%3E"
        },
        {
          "name": "[tomee-commits] 20201013 [jira] [Updated] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/raa4123e472175bb052fbba165d37187cea923f755e8f3f30d124cb3f%40%3Ccommits.tomee.apache.org%3E"
        },
        {
          "name": "[tomee-commits] 20201013 [jira] [Assigned] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc8473b08abdf3c16494ed817bec1717a0ee0c8080315bc27db5f21c3%40%3Ccommits.tomee.apache.org%3E"
        },
        {
          "name": "[tomee-commits] 20201013 [jira] [Commented] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf59c72572b9fee674a5d5cc6afeca4ffc3918a02c354a81cc50b7119%40%3Ccommits.tomee.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
        },
        {
          "name": "USN-4596-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4596-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "name": "[tomcat-dev] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210301 CVE-2021-25329: Apache Tomcat Incomplete fix for CVE-2020-9484",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/01/2"
        },
        {
          "name": "[tomee-commits] 20210522 [jira] [Closed] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r8dd19c514face6dd85fd4eab0271854883f40c7307926c1f7cd5400c%40%3Ccommits.tomee.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "name": "[tomcat-users] 20210701 What is \"h2c\"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20210701 Re: What is \"h2c\"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20210702 Re: CVE-2021-25329, was Re: Most recent security-related update to 8.5",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20210712 svn commit: r1891484 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc1778b38e74b5b6142414d57623bd55b023a72361f422836782fca3c%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2020-9484",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Tomcat",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Apache Tomcat 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, 7.0.0 to 7.0.103"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[tomcat-users] 20200521 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[debian-lts-announce] 20200523 [SECURITY] [DLA 2217-1] tomcat7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00020.html"
            },
            {
              "name": "[tomcat-users] 20200524 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "openSUSE-SU-2020:0711",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html"
            },
            {
              "name": "[tomcat-dev] 20200527 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html"
            },
            {
              "name": "20200602 [CVE-2020-9484] Apache Tomcat RCE via PersistentManager",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2020/Jun/6"
            },
            {
              "name": "GLSA-202006-21",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-21"
            },
            {
              "name": "FEDORA-2020-ce396e7d5c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/"
            },
            {
              "name": "FEDORA-2020-d9169235a8",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/"
            },
            {
              "name": "[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[debian-lts-announce] 20200712 [SECURITY] [DLA 2279-1] tomcat8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200528-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200528-0005/"
            },
            {
              "name": "http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html"
            },
            {
              "name": "DSA-4727",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4727"
            },
            {
              "name": "USN-4448-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4448-1/"
            },
            {
              "name": "[tomee-commits] 20201013 [jira] [Created] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r123b3ebe389f46f9d337923f393cdae4d3e9b78d982d706712f0898c@%3Ccommits.tomee.apache.org%3E"
            },
            {
              "name": "[tomee-commits] 20201013 [jira] [Updated] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/raa4123e472175bb052fbba165d37187cea923f755e8f3f30d124cb3f@%3Ccommits.tomee.apache.org%3E"
            },
            {
              "name": "[tomee-commits] 20201013 [jira] [Assigned] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rc8473b08abdf3c16494ed817bec1717a0ee0c8080315bc27db5f21c3@%3Ccommits.tomee.apache.org%3E"
            },
            {
              "name": "[tomee-commits] 20201013 [jira] [Commented] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf59c72572b9fee674a5d5cc6afeca4ffc3918a02c354a81cc50b7119@%3Ccommits.tomee.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
            },
            {
              "name": "USN-4596-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4596-1/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "[tomcat-dev] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.tomcat.apache.org%3E"
            },
            {
              "name": "[oss-security] 20210301 CVE-2021-25329: Apache Tomcat Incomplete fix for CVE-2020-9484",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/03/01/2"
            },
            {
              "name": "[tomee-commits] 20210522 [jira] [Closed] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r8dd19c514face6dd85fd4eab0271854883f40c7307926c1f7cd5400c@%3Ccommits.tomee.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "[tomcat-users] 20210701 What is \"h2c\"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20210701 Re: What is \"h2c\"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20210702 Re: CVE-2021-25329, was Re: Most recent security-related update to 8.5",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20210712 svn commit: r1891484 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rc1778b38e74b5b6142414d57623bd55b023a72361f422836782fca3c@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2020-9484",
    "datePublished": "2020-05-20T18:26:41.000Z",
    "dateReserved": "2020-03-01T00:00:00.000Z",
    "dateUpdated": "2024-08-04T10:26:16.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22060 (GCVE-0-2021-22060)

Vulnerability from cvelistv5 – Published: 2022-01-07 22:39 – Updated: 2024-08-03 18:30

Summary

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.

Severity

No CVSS data available.

CWE

Malicious input to cause the insertion of additional log entries.

Assigner

vmware

References

2 references

URL	Tags
https://tanzu.vmware.com/security/cve-2021-22060	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Spring Framework	Affected: Spring Framework 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:30:23.916Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2021-22060"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Spring Framework",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Spring Framework 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Malicious input to cause the insertion of additional log entries.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-19T23:24:11.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://tanzu.vmware.com/security/cve-2021-22060"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2021-22060",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Spring Framework",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Spring Framework 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Malicious input to cause the insertion of additional log entries."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tanzu.vmware.com/security/cve-2021-22060",
              "refsource": "MISC",
              "url": "https://tanzu.vmware.com/security/cve-2021-22060"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2021-22060",
    "datePublished": "2022-01-07T22:39:55.000Z",
    "dateReserved": "2021-01-04T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:30:23.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22096 (GCVE-0-2021-22096)

Vulnerability from cvelistv5 – Published: 2021-10-28 15:22 – Updated: 2024-08-03 18:30

Summary

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

Severity

No CVSS data available.

CWE

CWE-117 - Improper Output Neutralization for Logs

Assigner

vmware

References

3 references

URL	Tags
https://tanzu.vmware.com/security/cve-2021-22096	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2021112…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
n/a	Spring Framework	Affected: Spring Framework versions 5.3.x prior to 5.3.12+, 5.2.x prior to 5.2.18+ and all older unsupported versions are impacted.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:30:23.932Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2021-22096"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211125-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Spring Framework",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Spring Framework versions 5.3.x prior to 5.3.12+, 5.2.x prior to  5.2.18+ and all older unsupported versions are impacted."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-19T23:24:13.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://tanzu.vmware.com/security/cve-2021-22096"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211125-0005/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2021-22096",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Spring Framework",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Spring Framework versions 5.3.x prior to 5.3.12+, 5.2.x prior to  5.2.18+ and all older unsupported versions are impacted."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-117: Improper Output Neutralization for Logs"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tanzu.vmware.com/security/cve-2021-22096",
              "refsource": "MISC",
              "url": "https://tanzu.vmware.com/security/cve-2021-22096"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211125-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211125-0005/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2021-22096",
    "datePublished": "2021-10-28T15:22:35.000Z",
    "dateReserved": "2021-01-04T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:30:23.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22119 (GCVE-0-2021-22119)

Vulnerability from cvelistv5 – Published: 2021-06-29 16:15 – Updated: 2024-08-03 18:30

Summary

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.

Severity

No CVSS data available.

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

vmware

References

9 references

URL	Tags
https://tanzu.vmware.com/security/cve-2021-22119	x_refsource_MISC
https://lists.apache.org/thread.html/r163b3e4e398…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r390783b3b1c…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r3868207b967…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r89aa1b48a82…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/ra53677224fe…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r08a44901078…	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Spring Security	Affected: Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:30:23.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2021-22119"
          },
          {
            "name": "[portals-pluto-dev] 20210714 [jira] [Updated] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14%40%3Cpluto-dev.portals.apache.org%3E"
          },
          {
            "name": "[portals-pluto-dev] 20210714 [jira] [Reopened] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde%40%3Cpluto-dev.portals.apache.org%3E"
          },
          {
            "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3%40%3Cpluto-dev.portals.apache.org%3E"
          },
          {
            "name": "[portals-pluto-dev] 20210714 [jira] [Comment Edited] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f%40%3Cpluto-dev.portals.apache.org%3E"
          },
          {
            "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-786 Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc%40%3Cpluto-scm.portals.apache.org%3E"
          },
          {
            "name": "[nifi-issues] 20210726 [jira] [Created] (NIFI-8948) Upgrade Spring Framework to 5.3.9 and Spring Security to 5.5.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r08a449010786e0bcffa4b5781b04fcb55d6eafa62cb79b8347680aad%40%3Cissues.nifi.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Spring Security",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:25:05.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://tanzu.vmware.com/security/cve-2021-22119"
        },
        {
          "name": "[portals-pluto-dev] 20210714 [jira] [Updated] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14%40%3Cpluto-dev.portals.apache.org%3E"
        },
        {
          "name": "[portals-pluto-dev] 20210714 [jira] [Reopened] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde%40%3Cpluto-dev.portals.apache.org%3E"
        },
        {
          "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3%40%3Cpluto-dev.portals.apache.org%3E"
        },
        {
          "name": "[portals-pluto-dev] 20210714 [jira] [Comment Edited] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f%40%3Cpluto-dev.portals.apache.org%3E"
        },
        {
          "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-786 Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc%40%3Cpluto-scm.portals.apache.org%3E"
        },
        {
          "name": "[nifi-issues] 20210726 [jira] [Created] (NIFI-8948) Upgrade Spring Framework to 5.3.9 and Spring Security to 5.5.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r08a449010786e0bcffa4b5781b04fcb55d6eafa62cb79b8347680aad%40%3Cissues.nifi.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2021-22119",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Spring Security",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400: Uncontrolled Resource Consumption"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tanzu.vmware.com/security/cve-2021-22119",
              "refsource": "MISC",
              "url": "https://tanzu.vmware.com/security/cve-2021-22119"
            },
            {
              "name": "[portals-pluto-dev] 20210714 [jira] [Updated] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
              "name": "[portals-pluto-dev] 20210714 [jira] [Reopened] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
              "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
              "name": "[portals-pluto-dev] 20210714 [jira] [Comment Edited] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
              "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-786 Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc@%3Cpluto-scm.portals.apache.org%3E"
            },
            {
              "name": "[nifi-issues] 20210726 [jira] [Created] (NIFI-8948) Upgrade Spring Framework to 5.3.9 and Spring Security to 5.5.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r08a449010786e0bcffa4b5781b04fcb55d6eafa62cb79b8347680aad@%3Cissues.nifi.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2021-22119",
    "datePublished": "2021-06-29T16:15:05.000Z",
    "dateReserved": "2021-01-04T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:30:23.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22569 (GCVE-0-2021-22569)

Vulnerability from cvelistv5 – Published: 2022-01-07 00:00 – Updated: 2025-04-21 13:57

Title

Denial of Service of protobuf-java parsing procedure

Summary

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-696 - Incorrect Behavior Order

Assigner

Google

References

6 references

URL	Tags
https://bugs.chromium.org/p/oss-fuzz/issues/detai…
https://cloud.google.com/support/bulletins#gcp-2022-001
http://www.openwall.com/lists/oss-security/2022/01/12/4	mailing-list
http://www.openwall.com/lists/oss-security/2022/01/12/7	mailing-list
https://www.oracle.com/security-alerts/cpuapr2022.html
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Impacted products

3 products

Vendor	Product	Version
Google LLC	protobuf-java	Affected: unspecified , < 3.16.1 (custom) Affected: unspecified , < 3.18.2 (custom) Affected: unspecified , < 3.19.2 (custom)
Google LLC	protobuf-kotlin	Affected: unspecified , < 3.18.2 (custom) Affected: unspecified , < 3.19.2 (custom)
Google LLC	google-protobuf [JRuby Gem]	Affected: unspecified , < 3.19.2 (custom)

Credits

OSS-Fuzz - https://github.com/google/oss-fuzz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:44:14.144Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cloud.google.com/support/bulletins#gcp-2022-001"
          },
          {
            "name": "[oss-security] 20220112 CVE-2021-22569: Protobuf Java, Kotlin, JRuby DoS",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/01/12/4"
          },
          {
            "name": "[oss-security] 20220112 Re: CVE-2021-22569: Protobuf Java, Kotlin, JRuby DoS",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/01/12/7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "name": "[debian-lts-announce] 20230418 [SECURITY] [DLA 3393-1] protobuf security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-22569",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-21T13:40:37.923955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-21T13:57:08.444Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "protobuf-java",
          "vendor": "Google LLC",
          "versions": [
            {
              "lessThan": "3.16.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "3.18.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "3.19.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "protobuf-kotlin",
          "vendor": "Google LLC",
          "versions": [
            {
              "lessThan": "3.18.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "3.19.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "google-protobuf [JRuby Gem]",
          "vendor": "Google LLC",
          "versions": [
            {
              "lessThan": "3.19.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "OSS-Fuzz - https://github.com/google/oss-fuzz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696 Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-18T00:00:00.000Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330"
        },
        {
          "url": "https://cloud.google.com/support/bulletins#gcp-2022-001"
        },
        {
          "name": "[oss-security] 20220112 CVE-2021-22569: Protobuf Java, Kotlin, JRuby DoS",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/01/12/4"
        },
        {
          "name": "[oss-security] 20220112 Re: CVE-2021-22569: Protobuf Java, Kotlin, JRuby DoS",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/01/12/7"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "name": "[debian-lts-announce] 20230418 [SECURITY] [DLA 3393-1] protobuf security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Denial of Service of protobuf-java parsing procedure",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2021-22569",
    "datePublished": "2022-01-07T00:00:00.000Z",
    "dateReserved": "2021-01-05T00:00:00.000Z",
    "dateUpdated": "2025-04-21T13:57:08.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2022-0607

CVE-2020-15250 (GCVE-0-2020-15250)

CVE-2020-25689 (GCVE-0-2020-25689)

CVE-2020-29582 (GCVE-0-2020-29582)

CVE-2020-36518 (GCVE-0-2020-36518)

CVE-2020-7020 (GCVE-0-2020-7020)

CVE-2020-9484 (GCVE-0-2020-9484)

CVE-2021-22060 (GCVE-0-2021-22060)

CVE-2021-22096 (GCVE-0-2021-22096)

CVE-2021-22119 (GCVE-0-2021-22119)

CVE-2021-22569 (GCVE-0-2021-22569)

Tags

Sightings

Nomenclature