Lucene search

GitHub Advisory DatabaseGHSA-C4R5-XVGW-2942

HistoryApr 19, 2022 - 12:00 a.m.

Metrics exposure in Wildfly

2022-04-1900:00:50

CWE-200

GitHub Advisory Database

github.com

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

35.0%

JSON

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data.

Affected configurations

Vulners

Node

org.wildfly\wildflyMatchmetrics

CPENameOperatorVersion
org.wildfly:wildfly-metricsle23.0.0.Final

CPE	Name	Operator	Version
	org.wildfly:wildfly-metrics	le	23.0.0.Final

References

access.redhat.com/security/cve/CVE-2021-3503

bugzilla.redhat.com/show_bug.cgi?id=1942693

github.com/advisories/GHSA-c4r5-xvgw-2942

github.com/wildfly/wildfly/pull/14136

issues.redhat.com/browse/WFLY-11933

nvd.nist.gov/vuln/detail/CVE-2021-3503

security.netapp.com/advisory/ntap-20220609-0004/

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

35.0%

JSON

Related for GHSA-C4R5-XVGW-2942