Low severity · published Aug 26, 2022
CVE-2021-3644
A flaw was found in wildfly-core in all versions
3.3
CVSS
1%
EPSS
No
On KEV
Description
A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Descision Manager · Redhat
7.0 · source: NVD
WI
Wildfly · Redhat
16.0.0; 17.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3644
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3644
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3644
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1976052
Patch
https://github.com/wildfly/wildfly-core/commit/06dd9884f6ba50470b1fb5a35198a8784f037714
Patch
https://github.com/wildfly/wildfly-core/commit/6d8db43cd43b5994b7a14003db978064e086090b
Patch
https://github.com/wildfly/wildfly-core/pull/4668
Patch
https://issues.redhat.com/browse/WFCORE-5511
More from Descision Manager
7.5
CVE-2019-14839
It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using some tool like burp…
7.5
CVE-2022-0853
A flaw was found in JBoss-client
7.5
CVE-2020-10714
A flaw was found in WildFly Elytron version 1.11.3.Final and before
7.4
CVE-2021-20218
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after
6.7
CVE-2021-4178
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above