Skip to content
OpenAdvisories
Medium · 6.5 CVE-2023-4061 EUVD-2023-2843GHSA-26qx-4m49-6cfr

Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor

Published Nov 8, 2023 · Updated Sep 23, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat JBoss Enterprise Application Platform Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Product: Red Hat JBoss Enterprise Application Platform 8 Package: org.wildfly.core:wildfly-controller Ecosystem: Maven

Description

A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat JBoss Enterprise Application Platform — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.16.0-15.redhat_00049.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-bouncycastle +5 1.76.0-4.redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-hal-console 3.3.19-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.31-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.15-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-jboss-marshalling +1 2.0.13-2.SP1_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-jboss-modules 1.12.2-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-31.Final_redhat_00030.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.8.10-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-mod_cluster 1.4.5-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-netty +28 4.1.94-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-resteasy +18 3.15.8-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.13-8.GA_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.15.20-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.13-8.GA_redhat_00001.1.el8eap RHSA-2023:5486, RHSA-2023:5485

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wildfly.core:wildfly-controller < 22.0.0.Final 22.0.0.Final GHSA-26qx-4m49-6cfr

Advisories 3

References