Red Hat JBoss Core Services Httpd vulnerabilities

2 CVEs affecting Red Hat JBoss Core Services Httpd, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-3688, published 2022-08-26.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-3688, published 2022-08-26. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolon(s). This flaw could…
• CVE-2020-25680, published 2021-01-07. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and…