PT-2023-27539 · Unknown · Wildfly-Core

Patrick Del Bello · Published 2023-11-08 · Updated 2023-11-16 · CVE-2023-4061

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wildfly-core (affected versions not specified)

Description A flaw in wildfly-core allows a management user to use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This could enable a malicious user to access the system and obtain sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-4061

GHSA-26QX-4M49-6CFR

RHSA-2023:5484

RHSA-2023:5485

RHSA-2023:5486

Affected Products

Wildfly-Core

References · 12

• https://access.redhat.com/errata/RHSA-2023:5485 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:5484 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:5488 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-26qx-4m49-6cfr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4061 · Security Note
• https://access.redhat.com/errata/RHSA-2023:5486 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4061 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-4061 · Vendor Advisory
• https://github.com/wildfly/wildfly-core · Note
• https://github.com/wildfly/wildfly-core/commit/25728f370c2e90969854717ba4bb5182727f3f49 · Note
• https://github.com/wildfly/wildfly-core/pull/5703 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2228608 · Note