CVE-2021-20306 Information disclosure in Business-central
Authenticated users can view Ruleflow Group names from unauthorized projects, leading to information disclosure in jBPM Business Central.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20306?
CVE-2021-20306 is a medium-severity vulnerability in Business-central, published on 1 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.
Weakness: CWE-863
Which versions are affected by CVE-2021-20306?
It affects 3 products.
Products include Redhat Descision Manager, Redhat Jbpm, Redhat Process Automation.
How do I fix CVE-2021-20306?
No fix has been published for CVE-2021-20306 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20306 being exploited?
There is no known exploitation of CVE-2021-20306 in the wild and no public exploit code.
Other vulnerabilities in Business-central
Sources
Also known as GHSA-vjmm-vxxf-qmx4.