5.3

CVE-2021-3642

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Wildfly Elytron Version < 1.10.14
Redhat ≫ Wildfly Elytron Version >= 1.11.0 < 1.15.5
Redhat ≫ Wildfly Elytron Version >= 1.16.0 < 1.16.1
Redhat ≫ Build Of Quarkus Version -
Redhat ≫ Codeready Studio Version 12.0
Redhat ≫ Data Grid Version 8.0
Redhat ≫ Descision Manager Version 7.0
Redhat ≫ Integration Camel K Version -
Redhat ≫ Jboss Fuse Version 7.0.0
Redhat ≫ Process Automation Version 7.0
Quarkus ≫ Quarkus Version <= 2.1.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.85% 0.532
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 1.6 3.6
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:P/I:N/A:N
CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

https://bugzilla.redhat.com/show_bug.cgi?id=1981407
Vendor Advisory
Issue Tracking