Skip to content
Fencer Vulns
high 7.8

CVE-2021-3717 json

Wildfly-Core user account mismanagement

published 2022-05-24 4 y ago modified 2026-06-17 4 mo ago also GHSA-p9xf-3rm3-qh2h , EUVD-2022-4736

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.

Patch / fix

  • maven org.wildfly.core:wildfly-core-parent 17.0
  • redhat wildfly_core 17.0
  • eap7-jsoup jboss enterprise application platform 7.4, jboss enterprise application platform 7.3 1.14.2-1.redhat_00002.1.el8eap
  • eap7-wss4j jboss enterprise application platform 7.3 2.2.7-1.redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.3 7.3.10-2.GA_redhat_00003.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.3 3.11.5-1.Final_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.3 2.0.41-1.SP1_redhat_00001.1.el8eap
  • eap7-apache-cxf jboss enterprise application platform 7.3 3.3.12-1.redhat_00001.1.el8eap
  • eap7-jakarta-el jboss enterprise application platform 7.3 3.0.3-3.redhat_00007.1.el8eap
  • eap7-ironjacamar jboss enterprise application platform 7.3 1.5.3-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2025:1746RHSA-2021:5151RHSA-2021:5150RHSA-2021:5149RHSA-2021:4677RHSA-2021:4676

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3717 updated cvss 7.8

wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users

  • Red Hat Data Grid 8 wildfly wildfly
    affected: no fix available “Fix deferred”
  • Red Hat Integration Camel K 1 wildfly wildfly Red Hat Integration Service Registry wildfly wildfly
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Data Grid 7 wildfly wildfly Red Hat JBoss Data Virtualization 6 jbossas jbossas, wildfly wildfly Red Hat JBoss Enterprise Application Platform 5 jbossas jbossas Red Hat JBoss Enterprise Application Platform 6 jbossas jbossas
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack wildfly wildfly
    affected: no fix available
  • Red Hat JBoss Fuse 6 wildfly wildfly Red Hat JBoss Operations Network 3 wildfly wildfly Red Hat JBoss SOA Platform 5 jbossas jbossas
    affected: no fix planned “Out of support scope”
  • Red Hat EAP 7.3.10 GA
    fixed: vendor fix RHSA-2021:5154
  • Red Hat EAP-XP 2 via EAP 7.3.x base
    fixed: vendor fix RHSA-2022:0146
  • Red Hat Fuse 7.11.1
    fixed: vendor fix RHSA-2022:8652
show 10 more
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wss4j 2.2.7-1.redhat_00001.1.el8eap, eap7-jsoup 1.14.2-1.redhat_00002.1.el8eap, eap7-jakarta-el 3.0.3-3.redhat_00007.1.el8eap, eap7-apache-cxf 3.3.12-1.redhat_00001.1.el8eap, eap7-wildfly 7.3.10-2.GA_redhat_00003.1.el8eap, eap7-wss4j-policy 2.2.7-1.redhat_00001.1.el8eap, +66 more
    fixed: vendor fix RHSA-2021:5151
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wss4j 2.2.7-1.redhat_00001.1.el6eap, eap7-jsoup 1.14.2-1.redhat_00002.1.el6eap, eap7-jakarta-el 3.0.3-3.redhat_00007.1.el6eap, eap7-apache-cxf 3.3.12-1.redhat_00001.1.el6eap, eap7-wildfly 7.3.10-2.GA_redhat_00003.1.el6eap, eap7-wss4j-policy 2.2.7-1.redhat_00001.1.el6eap, +66 more
    fixed: vendor fix RHSA-2021:5149
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wss4j 2.2.7-1.redhat_00001.1.el7eap, eap7-jsoup 1.14.2-1.redhat_00002.1.el7eap, eap7-jakarta-el 3.0.3-3.redhat_00007.1.el7eap, eap7-apache-cxf 3.3.12-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.10-2.GA_redhat_00003.1.el7eap, eap7-wss4j-policy 2.2.7-1.redhat_00001.1.el7eap, +68 more
    fixed: vendor fix RHSA-2021:5150
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.2-2.GA_redhat_00002.1.el7eap, eap7-wildfly-modules 7.4.2-2.GA_redhat_00002.1.el7eap, eap7-wildfly-javadocs 7.4.2-2.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk8 7.4.2-2.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk11 7.4.2-2.GA_redhat_00002.1.el7eap
    fixed: vendor fix RHSA-2021:4676
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.2-2.GA_redhat_00002.1.el8eap, eap7-wildfly-modules 7.4.2-2.GA_redhat_00002.1.el8eap, eap7-wildfly-javadocs 7.4.2-2.GA_redhat_00002.1.el8eap
    fixed: vendor fix RHSA-2021:4677
  • Red Hat JBoss Enterprise Application Platform wildfly-cli 15.0.5.Final-redhat-00001
    fixed: vendor fix RHSA-2021:4679
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.9-2.GA_redhat_00002.1.ep7.el7, eap7-resteasy 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-wildfly-modules 7.1.9-2.GA_redhat_00002.1.ep7.el7, eap7-resteasy-cdi 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-jaxrs 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-jsapi 3.0.27-1.Final_redhat_00001.1.ep7.el7, +13 more
    fixed: vendor fix RHSA-2025:1746
  • Red Hat Single Sign-On 7.4.10
    fixed: vendor fix RHSA-2021:5170
  • Red Hat RHPAM 7.13.0 async
    fixed: vendor fix RHSA-2022:5903
  • Red Hat AMQ Broker 7 wildfly wildfly Red Hat Integration Camel Quarkus 1 wildfly wildfly Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wss4j 2.2.7-1.redhat_00001.1.el7eap, eap7-jsoup 1.14.2-1.redhat_00002.1.el7eap, eap7-jakarta-el 3.0.3-3.redhat_00007.1.el7eap, eap7-apache-cxf 3.3.12-1.redhat_00001.1.el7eap, eap7-apache-sshd 2.7.0-1.redhat_00001.1.el7eap, eap7-byte-buddy 1.11.12-2.redhat_00002.1.el7eap, +71 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wss4j 2.2.7-1.redhat_00001.1.el8eap, eap7-jsoup 1.14.2-1.redhat_00002.1.el8eap, eap7-jakarta-el 3.0.3-3.redhat_00007.1.el8eap, eap7-apache-cxf 3.3.12-1.redhat_00001.1.el8eap, eap7-apache-sshd 2.7.0-1.redhat_00001.1.el8eap, eap7-byte-buddy 1.11.12-2.redhat_00002.1.el8eap, +71 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1445 more Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jettison 1.3.8-2.redhat_00002.1.ep7.el7, eap7-velocity 1.7.0-3.redhat_00006.1.ep7.el7, eap7-apache-cxf 3.1.16-4.redhat_00003.1.ep7.el7, eap7-netty 4.1.63-1.Final_redhat_00002.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-4.redhat_00003.1.ep7.el7, eap7-snakeyaml 1.33.0-1.SP1_redhat_00001.1.ep7.el7, +4 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.wildfly.core:wildfly-core-parent
<17.0
17.0

Affected products

  • n/a wildfly

Classification

Weakness
  • CWE-552 Files or Directories Accessible to External Parties

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.