PT-2022-10637 · Red Hat · Wildfly

Kunjan Rathod · Published 2022-05-24 · Updated 2022-11-10 · CVE-2021-3717

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wildfly versions prior to 17.0

Description A flaw was found in Wildfly, where an incorrect JBOSS LOCAL USER challenge location when using the elytron configuration may lead to JBOSS LOCAL USER access to all users on the machine. The highest threat from this issue is to confidentiality, integrity, and availability.

Recommendations For versions prior to 17.0, update to version 17.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the elytron configuration to minimize the risk of exploitation.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2021-3717

GHSA-P9XF-3RM3-QH2H

RHSA-2021:4676

RHSA-2021:4677

RHSA-2021:5149

RHSA-2021:5150

RHSA-2021:5151

RHSA-2025:1746

Affected Products

Wildfly

References · 6

• https://osv.dev/vulnerability/GHSA-p9xf-3rm3-qh2h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3717 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3717 · Vendor Advisory
• https://t.me/cibsecurity/43295 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220804-0002 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1991305 · Note