Vulnerability Details : CVE-2021-3859
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
Vulnerability category: Denial of service
Products affected by CVE-2021-3859
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:single_sign-on:7.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:single_sign-on:7.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*
Threat overview for CVE-2021-3859
Top countries where our scanners detected CVE-2021-3859
Top open port discovered on systems with this issue
80
IPs affected by CVE-2021-3859 4,833
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2021-3859!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2021-3859
0.34%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 71 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-3859
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2021-3859
-
A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.Assigned by: secalert@redhat.com (Primary)
-
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.Assigned by: nvd@nist.gov (Secondary)
References for CVE-2021-3859
-
https://bugzilla.redhat.com/show_bug.cgi?id=2010378
2010378 – (CVE-2021-3859) CVE-2021-3859 undertow: client side invocation timeout raised when calling over HTTP2Issue Tracking;Vendor Advisory
-
https://security.netapp.com/advisory/ntap-20221201-0004/
CVE-2021-3859 Undertow Vulnerability in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://issues.redhat.com/browse/UNDERTOW-1979
[UNDERTOW-1979] CVE-2021-3859 Continuation frames are not read correctly - Red Hat Issue TrackerIssue Tracking;Patch;Vendor Advisory
-
https://github.com/undertow-io/undertow/pull/1296
[UNDERTOW-1979] CVE-2021-3859 continuation frames are not read correctly by fl4via · Pull Request #1296 · undertow-io/undertow · GitHubThird Party Advisory
-
https://access.redhat.com/security/cve/CVE-2021-3859
CVE-2021-3859- Red Hat Customer PortalVendor Advisory
-
https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2
[UNDERTOW-1979] CVE-2021-3859 continuation frames are not read correctly · undertow-io/undertow@e43f0ad · GitHubPatch;Third Party Advisory
Jump to