Description

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.

Remediation

References

https://issues.redhat.com/browse/WFLY-11933

https://bugzilla.redhat.com/show_bug.cgi?id=1942693

https://access.redhat.com/security/cve/CVE-2021-3503

https://github.com/wildfly/wildfly/pull/14136

https://github.com/advisories/GHSA-c4r5-xvgw-2942

Related Vulnerabilities

CVE-2022-34817 Vulnerability in maven package de.einsundeins.jenkins.plugins.failedjobdeactivator:failedjobdeactivator

CVE-2021-31812 Vulnerability in maven package org.apache.pdfbox:pdfbox

CVE-2017-12612 Vulnerability in maven package org.apache.spark:spark-core_2.10

CVE-2023-22899 Vulnerability in maven package net.lingala.zip4j:zip4j

CVE-2021-37305 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory Issue Tracking Patch Third Party Advisory NVD-CWE-noinfo