Read the docs
TI-2021-02490 Aliases CVE-2021-3536GHSA-v2wx-jj66-2hp7

Cross-site scripting in wildfly

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 10 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.

Why it matters now

EPSS 0.00533 45th percentileScored 2026-11-07
Fix Partial org.wildfly:wildfly-parent (Maven): 23.0.2.FinalRed Hat: 10 advisoriesRed Hat: 10 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—wildflyWildfly 23.0.2.Final—No fix listedCNA
—org.wildfly:wildfly-parent (Maven)before 23.0.2.Final23.0.2.FinalPatch availableGHSA-v2wx-jj66-2hp7
  • wildfly Vendor— Affected Wildfly 23.0.2.Final Fixed in — No fix listed CNA
  • org.wildfly:wildfly-parent (Maven) Vendor— Affected before 23.0.2.Final Fixed in 23.0.2.Final Patch available GHSA-v2wx-jj66-2hp7

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:*7VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*before 23.0.2VulnerableRed Hat
  • cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:* Versions 7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* Versions before 23.0.2 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-v2wx-jj66-2hp7 org.wildfly:wildfly-parent (Maven) Fixed in 23.0.2.Final Advisory →

Red Hat 10 advisories

  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:3660 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update
    • Red Hat JBoss Enterprise Application Platform commons-io.commons-io-2.10.0.redhat-00001.jar, io.netty.netty-all-4.1.63.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.9.SP1-redhat-00001.jar +5
  • RHSA-2021:3658 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el8eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el8eap +9
Show 7 more Red Hat advisories
  • RHSA-2021:3656 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el7eap +11
  • RHSA-2021:2965 Released 2021-07-29 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.8 security update
    • Red Hat Single Sign-On 7.4.8
  • RHSA-2021:2755 Released 2021-07-15 · Red Hat rating Moderate
    EAP XP 2 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
  • RHSA-2021:2694 Released 2021-07-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 8 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-elytron-web-1.6.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el8eap, eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el8eap +47
  • RHSA-2021:2692 Released 2021-07-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 6 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-elytron-web-1.6.3-1.Final_redhat_00001.1.el6eap, eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el6eap, eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el6eap +47
  • RHSA-2021:2693 Released 2021-07-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 7 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-elytron-web-1.6.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el7eap, eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el7eap +47
  • RHSA-2021:2696 Released 2021-07-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.8 security update
    • EAP 7.3.8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Data Grid 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat build of QuarkusAffectedNo fix yet: Fix deferred
Red Hat support for Spring BootAffectedNo fix yet: Fix deferred
EAP 7.3.8Fixed RHSA-2021:2696
Red Hat EAP-XP 2.0.0 via EAP 7.3.x baseFixed RHSA-2021:2755
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:2694
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:2692
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:2693
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2021:3656
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2021:3658
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2021:3660
Red Hat Single Sign-On 7.4.8Fixed RHSA-2021:2965
Not affected: 9 products
  • Red Hat AMQ Broker 7
  • Red Hat Decision Manager 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3536
  2. 2026-10-03 Alias added: GHSA-v2wx-jj66-2hp7

References

Advisory 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2022-03763 Injection in quarkus CVSS 3.1CRITICAL 9.8
  • TI-2023-05869 Quarkus: graphql operations over websockets bypass CVSS 3.1CRITICAL 9.1
  • TI-2023-04469 Quarkus: http security policy bypass CVSS 3.1HIGH 8.1
  • TI-2022-04106 Server-side request forgery in undertow CVSS 3.1HIGH 7.5
  • TI-2023-02786 Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced… CVSS 3.1HIGH 8.1
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences