CVE-2022-0853 : A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak

A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.

Published 2022-03-11 18:15:26

Updated 2022-03-18 13:51:23

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2022-0853

Redhat » Jboss Enterprise Application Platform » Version: 7.0.0
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
Matching versions
Redhat » Single Sign-on » Version: 7.0
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Process Automation » Version: 7.0
cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Descision Manager » Version: 7.0
cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Jboss Enterprise Application Platform Expansion Pack » Version: N/A
cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2022-0853

Top countries where our scanners detected CVE-2022-0853

Top open port discovered on systems with this issue 80

IPs affected by CVE-2022-0853 385

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2022-0853!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2022-0853

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 34 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-0853

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-0853

CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-0853

https://bugzilla.redhat.com/show_bug.cgi?id=2060725

2060725 – (CVE-2022-0853) CVE-2022-0853 jboss-client: memory leakage in remote client transaction
Issue Tracking;Vendor Advisory
https://github.com/ByteHackr/CVE-2022-0853

GitHub - ByteHackr/CVE-2022-0853
Exploit;Third Party Advisory