GoogleOSV:GHSA-26QX-4M49-6CFRwildfly-core Exposure of Sensitive Information to an Unauthorized Actor vulnerability
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
32.7%
A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.
References
access.redhat.com/errata/RHSA-2023:5484
access.redhat.com/errata/RHSA-2023:5485
access.redhat.com/errata/RHSA-2023:5486
access.redhat.com/errata/RHSA-2023:5488
access.redhat.com/security/cve/CVE-2023-4061
bugzilla.redhat.com/show_bug.cgi?id=2228608
github.com/wildfly/wildfly-core
github.com/wildfly/wildfly-core/commit/25728f370c2e90969854717ba4bb5182727f3f49
github.com/wildfly/wildfly-core/pull/5703
nvd.nist.gov/vuln/detail/CVE-2023-4061
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
32.7%