CVE-2023-4061 Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor

What is CVE-2023-4061?

CVE-2023-4061 is a medium-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 8 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.

Weakness: CWE-200

Which versions are affected by CVE-2023-4061?

2 open source packages ship an affected version, including org.wildfly.core:wildfly-controller. It affects 2 products.

Products include Redhat Jboss Enterprise Application Platform, Redhat Wildfly Core.

How do I fix CVE-2023-4061?

Upgrade org.wildfly.core:wildfly-controller to 22.0.0.Final or later.

Is CVE-2023-4061 being exploited?

There is no known exploitation of CVE-2023-4061 in the wild and no public exploit code.

Other vulnerabilities in Redhat Jboss Enterprise Application Platform

• CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution Exploited Critical 9.8
• CVE-2010-1428 Red Hat JBoss Information Disclosure Exploited Medium 5.9
• CVE-2010-0738 Red Hat JBoss Authentication Bypass Exploited Low 3.7
• CVE-2016-3690 Deserialization in n/a Critical 9.8
• CVE-2017-7504 Deserialization in JBoss Critical 9.8

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-26qx-4m49-6cfr.