CVE-2021-3536 Cross-site Scripting in Wildfly
Attackers can inject scripts via the role name field in WildFly's domain mode admin console, compromising confidentiality and integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-3536?
CVE-2021-3536 is a medium-severity cross-site scripting vulnerability in Redhat Jboss Enterprise Application Platform, published on 20 May 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
Weakness: CWE-79
Which versions are affected by CVE-2021-3536?
3 open source packages ship an affected version, including org.wildfly:wildfly-parent and wildfly. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
org.wildfly:wildfly-parent Maven | All versions | 23.0.2.Final |
org.wildfly:wildfly-parent Maven | All versions | 23.0.2.Final |
wildfly Bitnami | All versions | 23.0.2 |
Products include Redhat Build of Quarkus, Redhat Data Grid, Redhat Descision Manager, Redhat Integration Camel K, Redhat Integration Camel Quarkus, Redhat Integration Service Registry and 3 more.
How do I fix CVE-2021-3536?
Upgrade org.wildfly:wildfly-parent to 23.0.2.Final or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-3536 being exploited?
There is no known exploitation of CVE-2021-3536 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2022-4492 Undertow client not checking server identity presented by server certificate in https connections
- CVE-2023-2974 quarkus-core vulnerable to client driven TLS cipher downgrading
- CVE-2023-1664 Keycloak Untrusted Certificate Validation vulnerability
- CVE-2021-3914 SmallRye Health UI Cross-site Scripting vulnerability
- CVE-2023-6393 Quarkus: potential invalid reuse of context when @cacheresult on a uni is used
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as BIT-wildfly-2021-3536, GHSA-v2wx-jj66-2hp7.