PT-2021-3739 · Unknown · Wildfly-Core

Darran Lofthouse · Published 2021-06-25 · Updated 2024-03-06 · CVE-2021-3644

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions wildfly-core versions prior to the fixed version

Description The issue is related to flaws in the access control mechanism of the wildfly-core Java application server. This could allow a remote attacker to impact the confidentiality and integrity of protected information. A user with access to the management interface may potentially access vault expressions they should not have access to, possibly retrieving stored items. The highest threat from this issue is to data confidentiality and integrity.

Recommendations For wildfly-core versions prior to the fixed version, consider restricting access to the management interface to minimize the risk of exploitation. As a temporary workaround, limit the use of vault expressions in single attributes that contain multiple expressions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2021-03992

BIT-WILDFLY-2021-3644

CVE-2021-3644

GHSA-W88M-2936-RMXR

RHSA-2021:3466

RHSA-2021:3467

RHSA-2021:3468

RHSA-2021:3656

RHSA-2021:3658

Affected Products

Wildfly-Core

References · 14

• https://github.com/wildfly/wildfly-core/commit/6d8db43cd43b5994b7a14003db978064e086090b · Patch
• https://github.com/wildfly/wildfly-core/pull/4668 · Patch
• https://github.com/wildfly/wildfly-core/commit/06dd9884f6ba50470b1fb5a35198a8784f037714 · Patch
• https://access.redhat.com/security/cve/CVE-2021-3644 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1976052 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3644 · Security Note
• https://issues.redhat.com/browse/WFCORE-5511 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wildfly-2021-3644 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03992 · Security Note
• https://osv.dev/vulnerability/GHSA-w88m-2936-rmxr · Vendor Advisory
• https://github.com/wildfly/wildfly-core · Note
• https://access.redhat.com/security/cve/cve-2021-3644 · Note
• https://t.me/cibsecurity/48900 · Telegram Post