{"api_version":"1","generated_at":"2026-07-24T00:32:24+00:00","cve":"CVE-2021-3763","urls":{"html":"https://cve.report/CVE-2021-3763","api":"https://cve.report/api/cve/CVE-2021-3763.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-3763","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-3763"},"summary":{"title":"CVE-2021-3763","description":"A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the role the user is assigned to should not be allow access to the management console. The main impact is to confidentiality as this flaw means some role bindings are incorrectly checked, some privileged meta information such as queue names and configuration details are disclosed but the impact is limited as not all information is accessible and there is no affect to integrity.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2022-08-23 16:15:00","updated_at":"2022-08-27 02:06:00"},"problem_types":["CWE-863"],"metrics":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2021-3763","name":"https://access.redhat.com/security/cve/CVE-2021-3763","refsource":"MISC","tags":[],"title":"Red Hat Customer Portal - Access to 24x7 support and knowledge","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000654","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2000654","refsource":"MISC","tags":[],"title":"2000654 – (CVE-2021-3763) CVE-2021-3763 AMQ Broker 7: Incorrect privilege in Management Console","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://issues.redhat.com/browse/ENTMQBR-5372","name":"https://issues.redhat.com/browse/ENTMQBR-5372","refsource":"MISC","tags":[],"title":"[ENTMQBR-5372] User with a role not declared on RBAC, can access the console - Red Hat Issue Tracker","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3763","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3763","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"3763","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"amq_broker","cpe6":"7.8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"3763","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"amq_broker","cpe6":"7.8.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"3763","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"amq_broker","cpe6":"7.8.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2021-3763","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"AMQ Broker","version":{"version_data":[{"version_value":"Fixed in amq-7.9.0"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-863 - Incorrect Authorization"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2000654","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000654"},{"refsource":"MISC","name":"https://issues.redhat.com/browse/ENTMQBR-5372","url":"https://issues.redhat.com/browse/ENTMQBR-5372"},{"refsource":"MISC","name":"https://access.redhat.com/security/cve/CVE-2021-3763","url":"https://access.redhat.com/security/cve/CVE-2021-3763"}]},"description":{"description_data":[{"lang":"eng","value":"A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the role the user is assigned to should not be allow access to the management console. The main impact is to confidentiality as this flaw means some role bindings are incorrectly checked, some privileged meta information such as queue names and configuration details are disclosed but the impact is limited as not all information is accessible and there is no affect to integrity."}]}},"nvd":{"publishedDate":"2022-08-23 16:15:00","lastModifiedDate":"2022-08-27 02:06:00","problem_types":["CWE-863"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:amq_broker:7.8.2:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:amq_broker:7.8.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:amq_broker:7.8.1:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"3763","Ordinal":"216229","Title":"CVE-2021-3763","CVE":"CVE-2021-3763","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"3763","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}