{"id":"CVE-2021-20318","aliases":["EUVD-2021-7743","GHSA-36vx-8x4w-9h2m","RHSA-2022:0400","RHSA-2022:0401"],"status":"published","title":"The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A...","description":"The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01757,"percentile":0.78284,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2021-12-23T19:48:41Z","modified":"2026-10-02T10:01:43Z","affected":[{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-1.SP2_redhat_00001.1.el7eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hornetq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el7eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hornetq-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el7eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hornetq-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el7eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hornetq-jms-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el7eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-1.SP2_redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hornetq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hornetq-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hornetq-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hornetq-jms-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el8eap"}]}],"bundled":2}],"products":[{"vendor":"redhat","product":"jboss_enterprise_application_platform"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010559","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20318","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-36vx-8x4w-9h2m"},{"url":"https://access.redhat.com/errata/RHSA-2022:0400","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010378","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-22100","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22104","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22106","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22108","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22373","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22505","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22575","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22582","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22586","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22587","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22590","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22609","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22641","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22668","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22679","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22692","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22693","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22740","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22754","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22793","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22822","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22823","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22833","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22851","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0400.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3859","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20318","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20318","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0401","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-22642","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0401.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-20318","description":"The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.","status":"published","published":"2021-12-23T19:48:41Z","modified":"2024-08-03T17:37:23.724Z","cwes":["CWE-502"],"updated_at":"2026-11-02T14:32:55.564736Z"}],"euvd":[{"id":"EUVD-2021-7743","description":"The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.","status":"published","published":"2021-12-23T19:48:41Z","modified":"2024-08-03T17:37:23Z","updated_at":"2026-11-03T03:25:08.888273Z"}],"ghsa":[{"id":"GHSA-36vx-8x4w-9h2m","title":"The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A...","description":"The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.","status":"published","published":"2021-12-24T00:00:25Z","modified":"2023-02-03T05:03:30Z","cwes":["CWE-502"],"updated_at":"2026-11-02T14:53:22.246853Z"}],"nvd":[{"id":"CVE-2021-20318","description":"The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.","status":"published","published":"2021-12-23T20:15:08.927Z","modified":"2026-06-17T03:33:39.847Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:02.566991Z"}],"osv":[{"id":"RHSA-2022:0400","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.3 security update","status":"published","published":"2024-09-16T06:46:00Z","modified":"2026-10-02T10:01:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0401","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.3 security update","status":"published","published":"2024-09-16T06:45:52Z","modified":"2026-10-02T10:01:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"}]}}