Read the docs
TI-2023-03768 Aliases CVE-2023-4061GHSA-26qx-4m49-6cfr

Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor

Priority LOW 31CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01037 64th percentileScored 2026-11-07
Fix Fixed org.wildfly.core:wildfly-controller (Maven): 22.0.0.FinalRed Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat JBoss Enterprise Application Platform—15.0.32.Final-redhat-00001Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 8—7.4.13-8.GA_redhat_00001.1.el8eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 8—1.15.20-1.Final_redhat_00001.1.el8eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 9—7.4.13-8.GA_redhat_00001.1.el9eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 9—1.15.20-1.Final_redhat_00001.1.el9eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.4 on RHEL 7—7.4.13-8.GA_redhat_00001.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.4 on RHEL 7—1.15.20-1.Final_redhat_00001.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 8——Not affectedCNA
—org.wildfly.core:wildfly-controller (Maven)before 22.0.0.Final22.0.0.FinalPatch availableGHSA-26qx-4m49-6cfr
  • Red Hat JBoss Enterprise Application Platform VendorRed Hat Affected — Fixed in 15.0.32.Final-redhat-00001 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 7.4.13-8.GA_redhat_00001.1.el8eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.15.20-1.Final_redhat_00001.1.el8eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 7.4.13-8.GA_redhat_00001.1.el9eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.15.20-1.Final_redhat_00001.1.el9eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 7.4.13-8.GA_redhat_00001.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 1.15.20-1.Final_redhat_00001.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • org.wildfly.core:wildfly-controller (Maven) Vendor— Affected before 22.0.0.Final Fixed in 22.0.0.Final Patch available GHSA-26qx-4m49-6cfr

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*before 15.0.30VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0Running onRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:* Versions before 15.0.30 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat

Remediation

  • Fix · GHSA-26qx-4m49-6cfr org.wildfly.core:wildfly-controller (Maven) Fixed in 22.0.0.Final Advisory →

Red Hat 4 advisories

  • RHSA-2023:5485 Released 2023-10-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el8eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el8eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el8eap +47
  • RHSA-2023:5486 Released 2023-10-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el9eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el9eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el9eap +47
  • RHSA-2023:5484 Released 2023-10-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el7eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el7eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el7eap +47
Show 1 more Red Hat advisories
  • RHSA-2023:5488 Released 2023-10-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.13 security update
    • Red Hat JBoss Enterprise Application Platform io.netty.netty-handler-4.1.94.Final-redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.76.0.redhat-00001.jar, org.jboss.hal.hal-console-3.3.19.Final-redhat-00001-resources.jar +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:5484
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:5485
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:5486
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2023:5488
Not affected: 5 products
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4061
  2. 2026-10-03 Alias added: GHSA-26qx-4m49-6cfr

References

Advisory 6

Other 4

  • TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
  • TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 243 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences