Red Hat WildFly 17.0.0 Beta 1

CPE Details

Red Hat WildFly 17.0.0 Beta 1
redhat
wildfly
17.0.0
2019-08-19
16h28 +00:00
2019-08-19
16h28 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:redhat:wildfly:17.0.0:beta1:*:*:*:*:*:*

Informations

Vendor

redhat

Product

wildfly

Version

17.0.0

Update

beta1

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2022-1278 2022-09-13 11h38 +00:00 A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
7.5
Haute
CVE-2022-0866 2022-05-10 18h20 +00:00 This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.
5.3
Moyen
CVE-2021-3503 2022-04-18 14h20 +00:00 A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
4.3
Moyen
CVE-2020-1719 2021-06-07 14h23 +00:00 A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.
5.4
Moyen
CVE-2021-3536 2021-05-20 10h15 +00:00 A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
4.8
Moyen
CVE-2020-25640 2020-11-24 18h00 +00:00 A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.
5.3
Moyen
CVE-2020-25689 2020-10-29 23h00 +00:00 A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.
6.5
Moyen
CVE-2020-10740 2020-06-22 15h39 +00:00 A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.
7.5
Haute