Information Disclosure

2023-11-0907:59:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

wildfly-controller

vulnerability

resolve-expression

hal interface

authorization check

system property

environment variables

information disclosure

malicious user

sensitive information

software

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

32.5%

JSON

org.wildfly.core: wildfly-controller is vulnerable to Information Disclosure. The vulnerability is caused by a missing authorization check in the resolve-expression HAL interface while reading a system property or environment variables. This can lead to a malicious user accessing the Wildfly system and obtain sensitive information.