Skip to content
Fencer Vulns
medium 6.5

CVE-2023-4061 json

Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor

published 2023-11-08 3 y ago modified 2026-09-23 46 d ago also GHSA-26qx-4m49-6cfr , EUVD-2023-2843

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.

Patch / fix

  • maven org.wildfly.core:wildfly-controller 22.0.0.Final
  • Red Hat Red Hat JBoss Enterprise Application Platform 15.0.32.Final-redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:1.15.20-1.Final_redhat_00001.1.el8eap, 0:7.4.13-8.GA_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 0:1.15.20-1.Final_redhat_00001.1.el9eap, 0:7.4.13-8.GA_redhat_00001.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 0:1.15.20-1.Final_redhat_00001.1.el7eap, 0:7.4.13-8.GA_redhat_00001.1.el7eap
  • eap7-netty jboss enterprise application platform 7.4 4.1.94-1.Final_redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.13-8.GA_redhat_00001.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.4 3.15.8-1.Final_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.26-1.SP1_redhat_00001.1.el8eap
  • eap7-hibernate jboss enterprise application platform 7.4 5.3.31-1.Final_redhat_00001.1.el8eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.94-1.Final_redhat_00001.1.el8eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.19-1.Final_redhat_00001.1.el8eap
  • eap7-ironjacamar jboss enterprise application platform 7.4 1.5.15-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2023:5485RHSA-2023:5486RHSA-2023:5484

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-4061 updated cvss 6.5

wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an Unauthorized actor

  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el7eap, eap7-wildfly-modules 7.4.13-8.GA_redhat_00001.1.el7eap, eap7-wildfly-javadocs 7.4.13-8.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk8 7.4.13-8.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk11 7.4.13-8.GA_redhat_00001.1.el7eap, eap7-wildfly-elytron 1.15.20-1.Final_redhat_00001.1.el7eap, +1 more
    fixed: vendor fix “Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials.” RHSA-2023:5484
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el8eap, eap7-wildfly-modules 7.4.13-8.GA_redhat_00001.1.el8eap, eap7-wildfly-javadocs 7.4.13-8.GA_redhat_00001.1.el8eap, eap7-wildfly-java-jdk8 7.4.13-8.GA_redhat_00001.1.el8eap, eap7-wildfly-java-jdk11 7.4.13-8.GA_redhat_00001.1.el8eap, eap7-wildfly-java-jdk17 7.4.13-8.GA_redhat_00001.1.el8eap, +2 more
    fixed: vendor fix “Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials.” RHSA-2023:5485
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el9eap, eap7-wildfly-modules 7.4.13-8.GA_redhat_00001.1.el9eap, eap7-wildfly-javadocs 7.4.13-8.GA_redhat_00001.1.el9eap, eap7-wildfly-java-jdk8 7.4.13-8.GA_redhat_00001.1.el9eap, eap7-wildfly-java-jdk11 7.4.13-8.GA_redhat_00001.1.el9eap, eap7-wildfly-java-jdk17 7.4.13-8.GA_redhat_00001.1.el9eap, +2 more
    fixed: vendor fix “Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials.” RHSA-2023:5486
  • Red Hat JBoss Enterprise Application Platform wildfly-controller 15.0.32.Final-redhat-00001
    fixed: vendor fix “Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials.” RHSA-2023:5488
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-netty 4.1.94-1.Final_redhat_00001.1.el7eap, eap7-bouncycastle 1.76.0-4.redhat_00001.1.el7eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el7eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el7eap, eap7-hibernate 5.3.31-1.Final_redhat_00001.1.el7eap, +88 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-netty 4.1.94-1.Final_redhat_00001.1.el8eap, eap7-bouncycastle 1.76.0-4.redhat_00001.1.el8eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el8eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el8eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el8eap, eap7-hibernate 5.3.31-1.Final_redhat_00001.1.el8eap, +88 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-netty 4.1.94-1.Final_redhat_00001.1.el9eap, eap7-bouncycastle 1.76.0-4.redhat_00001.1.el9eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el9eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el9eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el9eap, eap7-hibernate 5.3.31-1.Final_redhat_00001.1.el9eap, +85 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1555 more Red Hat JBoss Enterprise Application Platform 8 wildfly-core wildfly-core
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.wildfly.core:wildfly-controller
<22.0.0.Final
22.0.0.Final

Affected products

  • Red Hat Red Hat JBoss Enterprise Application Platform
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.