Multiple vulnerabilities in Red Hat Process Automation Manager
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 12 |
| CVE-ID | CVE-2021-2471 CVE-2021-3642 CVE-2021-3644 CVE-2021-3717 CVE-2021-22569 CVE-2021-36373 CVE-2021-37136 CVE-2021-37137 CVE-2021-37714 CVE-2021-43797 CVE-2022-22950 CVE-2022-25647 |
| CWE-ID | CWE-20 CWE-203 CWE-284 CWE-552 CWE-399 CWE-400 CWE-835 CWE-444 CWE-185 CWE-502 |
| Exploitation vector | Network |
| Public exploit |
Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #5 is available. |
| Vulnerable software |
Red Hat Process Automation Manager (formerly JBoss BPM Suite) Web applications / Remote management & hosting panels |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 12 vulnerabilities.
1) Improper input validation
EUVDB-ID: #VU57510
Risk: Medium
CVSSv4.0: 5.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2021-2471
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a remote privileged user to read data or crash the application.
The vulnerability exists due to improper input validation within the Connector/J component in MySQL Connectors. A remote privileged user can exploit this vulnerability to read data or crash the application.
MitigationInstall updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Observable discrepancy
EUVDB-ID: #VU59661
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-3642
CWE-ID:
CWE-203 - Observable discrepancy
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to possibility of a timing attack against the ScramServer. A remote attacker can gain access to potentially sensitive information.
MitigationInstall updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper access control
EUVDB-ID: #VU54938
Risk: Medium
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-3644
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain unauthorized access to sensitive information.
The vulnerability exists due to improper access restrictions to vault expressions. A remote user with access to management interface can can access restricted vault and retrieve items stored in the vault, if a vault expression is in the form of a single attribute that contains multiple expressions.
Install updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Files or Directories Accessible to External Parties
EUVDB-ID: #VU58178
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-3717
CWE-ID:
CWE-552 - Files or Directories Accessible to External Parties
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an incorrect JBOSS_LOCAL_USER challenge location. A local unprivileged user can access any user account on the affected system.
Install updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Resource management error
EUVDB-ID: #VU60181
Risk: Medium
CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2021-22569
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the application. protobuf-java allowes the interleaving of
com.google.protobuf.UnknownFieldSet fields in such a way that would be
processed out of order. A small malicious payload can occupy the parser
for several minutes by creating large numbers of short-lived objects
that cause frequent, repeated pauses. A remote attacker can trick the victim into passing specially crafted data to the application and perform a denial of service attack.
Install updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
6) Resource exhaustion
EUVDB-ID: #VU54855
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-36373
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing TAR archives. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Resource exhaustion
EUVDB-ID: #VU63127
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-37136
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in Bzip2 decompression decoder function. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Improper input validation
EUVDB-ID: #VU59924
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-37137
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the Content Acquisition System (Netty) component in Oracle Commerce Guided Search. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Infinite loop
EUVDB-ID: #VU58176
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-37714
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when processing untrusted HTML and XML code. A remote attacker can consume all available system resources and cause denial of service conditions.
MitigationInstall updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Inconsistent interpretation of HTTP requests
EUVDB-ID: #VU61810
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-43797
CWE-ID:
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to preform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests when processing control chars present at the beginning / end of the header name. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
MitigationInstall updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Incorrect Regular Expression
EUVDB-ID: #VU61760
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-22950
CWE-ID:
CWE-185 - Incorrect Regular Expression
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due improper input validation when processing SpEL expressions. A remote attacker can send a specially crafted HTTP request to the affected application and perform a denial of service (DoS) attack.
Install updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Deserialization of Untrusted Data
EUVDB-ID: #VU64152
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-25647
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to insecure input validation when processing serialized data passed to writeReplace() method. A remote attacker can pass specially crafted data to the application and perform a denial of service attack.
MitigationInstall updates from vendor's website.
Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.12.1
CPE2.3- cpe:2.3:a:red_hat:jboss_bpm_suite:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:jboss_bpm_suite:7.2.0:*:*:*:*:*:*:*
http://access.redhat.com/errata/RHSA-2022:5903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
