CVE-2021-3536 — Cross-site Scripting in Wildfly

Description

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.

Affected products

Vendor	Product	Affected	Fixed
—	wildfly	Wildfly 23.0.2.Final	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 7	eap7-apache-commons-io	2.10.0-1.redhat_00001.1.el7eap	RHSA-2021:3658, RHSA-2021:3656
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.6.3-1.Final_redhat_00001.1.el6eap	RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692
Red Hat JBoss EAP 7	eap7-hal-console	3.2.15-1.Final_redhat_00001.1.el6eap	RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692
Red Hat JBoss EAP 7	eap7-hibernate +4	5.3.20-3.SP1_redhat_00001.1.el6eap	RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692
Red Hat JBoss EAP 7	eap7-infinispan +8	9.4.23-1.Final_redhat_00001.1.el6eap	RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.33-1.Final_redhat_00001.1.el6eap	RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692
Red Hat JBoss EAP 7	eap7-jakarta-el	3.0.3-2.redhat_00006.1.el7eap	RHSA-2021:3658, RHSA-2021:3656
Red Hat JBoss EAP 7	eap7-jberet +1	1.3.8-1.Final_redhat_00001.1.el6eap	RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692
Red Hat JBoss EAP 7	eap7-jboss-remoting	5.0.23-1.Final_redhat_00001.1.el6eap	RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692
Red Hat JBoss EAP 7	eap7-jboss-server-migration +21	1.7.2-7.Final_redhat_00008.1.el6eap	RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692
Red Hat JBoss EAP 7	eap7-netty +1	4.1.63-1.Final_redhat_00001.1.el6eap	RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2694
Red Hat JBoss EAP 7	eap7-undertow	2.0.38-1.SP1_redhat_00001.1.el6eap	RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2694
Red Hat JBoss EAP 7	eap7-velocity +1	2.3.0-1.redhat_00001.1.el7eap	RHSA-2021:3658, RHSA-2021:3656
Red Hat JBoss EAP 7	eap7-wildfly +2	7.3.8-1.GA_redhat_00001.1.el6eap	RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2694
Red Hat JBoss EAP 7	eap7-wildfly-elytron +1	1.10.13-1.Final_redhat_00001.1.el6eap	RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2694
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.28-1.Final_redhat_00001.1.el6eap	RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk8 +1	7.3.8-1.GA_redhat_00001.1.el7eap	RHSA-2021:3656, RHSA-2021:2693

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.wildfly:wildfly-parent	< 23.0.2.Final	23.0.2.Final	GHSA-v2wx-jj66-2hp7

Advisories 5

RHSA-2021:3658 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2021:3656 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2021:2694 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2021:2693 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2021:2692 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026

References

https://bugzilla.redhat.com/show_bug.cgi?id=1948001