org.jboss.resteasy.spring:shared (>=3.0.0.alpha1, <=3.0.0.alpha3), org.jboss.resteasy:arquillian-utils (>=6.0.0.beta1, <=6.1.0.beta2) +104 more potentially affected by CVE-2025-23367 via org.wildfly.core:wildfly-server (16.0.0.final)

org.wildfly.core:wildfly-server MAVEN version 16.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.core:wildfly-server and may be impacted: - org.jboss.resteasy.spring:shared =3.0.0.alpha1, =6.0.0.beta1, =6.1.0.beta2 -...

org.wildfly.core:wildfly-core-feature-pack-common (18.0.3.final), org.wildfly.core:wildfly-core-galleon-pack (18.0.3.final) +18 more potentially affected by CVE-2025-23367 via org.wildfly.core:wildfly-server (18.0.3.final)

org.wildfly.core:wildfly-server MAVEN version 18.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.core:wildfly-server and may be impacted: - org.wildfly.core:wildfly-core-feature-pack-common 18.0.3.final -...

org.wildfly.core:wildfly-core-dist-legacy (11.0.0.beta2), org.wildfly.core:wildfly-core-feature-pack (11.0.0.beta2) +18 more potentially affected by CVE-2025-23367 via org.wildfly.core:wildfly-server (11.0.0.beta2)

org.wildfly.core:wildfly-server MAVEN version 11.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.core:wildfly-server and may be impacted: - org.wildfly.core:wildfly-core-dist-legacy 11.0.0.beta2 -...

Duplicate Advisory: Wildfly Server Role Based Access Control (RBAC) provider has Improper Access Control

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qr6x-62gq-4ccp. This link is maintained to preserve external references. Original Description A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the execute functions in ServerSuspendHandler.java and ServerResumeHandler.java, which do not perform sufficient checks for the authorization of the running user. This allows a user with the Monitor or Auditor...

GHSA-FCRW-MPHX-7CXF Duplicate Advisory: Wildfly Server Role Based Access Control (RBAC) provider has Improper Access Control

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qr6x-62gq-4ccp. This link is maintained to preserve external references. Original Description A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control...

CVE-2025-23367

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2025-23367

The CVE-2025-23367 issue affects WildFly’s Server RBAC provider: Suspend and Resume handlers fail to perform authorization checks, allowing a user with Monitor/Auditor roles to suspend or resume the server. The vulnerability is tied to WildFly core/WildFly-server components and is acknowledged in...

CVE-2025-23367 Org.wildfly.core:wildfly-server: wildfly improper rbac permission

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2025-23367

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2025-23367 Org.wildfly.core:wildfly-server: wildfly improper rbac permission

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2025-23367 Org.wildfly.core:wildfly-server: wildfly improper rbac permission

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2025-23367

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2025-23367: Improper Access Control

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

Wildfly Server Role Based Access Control (RBAC) provider 安全漏洞

Wildfly is a powerful, modular and lightweight application server from Wildfly. A security vulnerability exists in the Wildfly Server Role Based Access Control RBAC provider, which stems from a lack of privilege validation for the Suspend and Resume operations, which allows an unprivileged user t...

编号撤回

Red Hat Undertow is a Java-based embedded web server from Red Hat USA and is the default web server for Wildfly Java Application Server. This CVE number has been withdrawn...

org.keycloak:keycloak-dependencies-server-min (4.8.0.final), org.keycloak:keycloak-model-jpa (4.8.0.final) +2 more potentially affected by CVE-2024-10270 via org.keycloak:keycloak-services (4.8.0.final)

org.keycloak:keycloak-services MAVEN version 4.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.8.0.final - org.keycloak:keycloak-model-jpa...

org.keycloak:keycloak-dependencies-server-min (4.0.0.beta3), org.keycloak:keycloak-model-jpa (4.0.0.beta3) +2 more potentially affected by CVE-2024-7341 via org.keycloak:keycloak-services (4.0.0.beta3)

org.keycloak:keycloak-services MAVEN version 4.0.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.0.0.beta3 - org.keycloak:keycloak-model-jpa...

io.github.johnjcool:keycloak-cas-services (>=4.1.0.final, <=4.1.1.final), org.keycloak:keycloak-dependencies-server-min (4.1.0.final) +3 more potentially affected by CVE-2024-8883 via org.keycloak:keycloak-services (4.1.0.final)

org.keycloak:keycloak-services MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.1.0.final, =4.1.1.final -...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-dependencies-server-min (4.3.0.final) +3 more potentially affected by CVE-2024-8883 via org.keycloak:keycloak-services (4.3.0.final)

org.keycloak:keycloak-services MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...