PT-2021-20899 · Red Hat · Wildfly

Damian Bury + 1 · Published 2021-05-20 · Updated 2024-03-06 · CVE-2021-3536

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Wildfly versions prior to 23.0.2.Final

Description: A flaw was found in Wildfly while creating a new role in domain mode via the admin console, allowing a payload to be added in the name field, leading to XSS. This affects Confidentiality and Integrity.

Recommendations: For versions prior to 23.0.2.Final, update to version 23.0.2.Final or later to resolve the issue. As a temporary workaround, consider restricting access to the admin console to minimize the risk of exploitation. Avoid using the name field in the role creation process until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-WILDFLY-2021-3536

CVE-2021-3536

GHSA-V2WX-JJ66-2HP7

RHSA-2021:2692

RHSA-2021:2693

RHSA-2021:2694

RHSA-2021:3656

RHSA-2021:3658

Affected Products

Wildfly

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-3536 · Security Note
• https://osv.dev/vulnerability/BIT-wildfly-2021-3536 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3536 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1948001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v2wx-jj66-2hp7 · Vendor Advisory
• https://t.me/cvenotify/14730 · Telegram Post
• https://t.me/cvenotify/15088 · Telegram Post