Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. org.wildfly.core/wildfly-server
  4. ›
  5. CVE-2021-3644

CVE-2021-3644: wildfly-core allows user with access to management interface to access vault expression, retrieve item from vault

August 27, 2022 (updated September 2, 2022)

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.

References

  • access.redhat.com/security/cve/CVE-2021-3644
  • bugzilla.redhat.com/show_bug.cgi?id=1976052
  • github.com/advisories/GHSA-w88m-2936-rmxr
  • github.com/wildfly/wildfly-core/commit/06dd9884f6ba50470b1fb5a35198a8784f037714
  • github.com/wildfly/wildfly-core/commit/6d8db43cd43b5994b7a14003db978064e086090b
  • github.com/wildfly/wildfly-core/pull/4668
  • issues.redhat.com/browse/WFCORE-5511
  • nvd.nist.gov/vuln/detail/CVE-2021-3644

Code Behaviors & Features

Detect and mitigate CVE-2021-3644 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 16.0.1.final, all versions starting from 17.0.0.beta2 before 17.0.0.beta3

Fixed versions

  • 16.0.1.Final
  • 17.0.0.Beta3

Solution

Upgrade to versions 16.0.1.Final, 17.0.0.Beta3 or above.

Impact 3.3 LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Learn more about CVSS

Source file

maven/org.wildfly.core/wildfly-server/CVE-2021-3644.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:14:58 +0000.