Wildfly Authorization Misconfiguration

2022-05-2416:58:43

Google

osv.dev

0.002 Low

EPSS

Percentile

60.2%

JSON

A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server

CPENameOperatorVersion
org.wildfly.core:wildfly-host-controllereq7.0.0.Beta1
org.wildfly.core:wildfly-host-controllereq1.0.0.Beta4
org.wildfly.core:wildfly-host-controllereq3.0.0.Beta24
org.wildfly.core:wildfly-host-controllereq3.0.10.Final
org.wildfly.core:wildfly-host-controllereq3.0.0.Alpha22
org.wildfly.core:wildfly-host-controllereq2.0.0.Alpha12
org.wildfly.core:wildfly-host-controllereq1.0.0.Alpha6
org.wildfly.core:wildfly-host-controllereq1.0.0.CR3
org.wildfly.core:wildfly-host-controllereq1.0.0.Alpha16
org.wildfly.core:wildfly-host-controllereq3.0.0.Alpha23

Name	Operator	Version
org.wildfly.core:wildfly-host-controller	eq	7.0.0.Beta1
org.wildfly.core:wildfly-host-controller	eq	1.0.0.Beta4
org.wildfly.core:wildfly-host-controller	eq	3.0.0.Beta24
org.wildfly.core:wildfly-host-controller	eq	3.0.10.Final
org.wildfly.core:wildfly-host-controller	eq	3.0.0.Alpha22
org.wildfly.core:wildfly-host-controller	eq	2.0.0.Alpha12
org.wildfly.core:wildfly-host-controller	eq	1.0.0.Alpha6
org.wildfly.core:wildfly-host-controller	eq	1.0.0.CR3
org.wildfly.core:wildfly-host-controller	eq	1.0.0.Alpha16
org.wildfly.core:wildfly-host-controller	eq	3.0.0.Alpha23