CVE-2021-3644

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.

CVSS v3.0 3.3 LOW

3.3^/10

CVSS v3.0 : LOW

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/wildfly/wildfly-core/commit/06dd9884f6ba50470b1fb5a35198a8784f037714	Patch Third Party Advisory
https://github.com/wildfly/wildfly-core/commit/6d8db43cd43b5994b7a14003db978064e086090b	Patch Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-3644	Vendor Advisory
https://github.com/wildfly/wildfly-core/pull/4668	Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1976052	Issue Tracking Vendor Advisory
https://issues.redhat.com/browse/WFCORE-5511	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:descision_manager:7.0:::::::*
	cpe:2.3:a:redhat:wildfly:16.0.0:-::::::
	cpe:2.3:a:redhat:wildfly:17.0.0:beta2::::::

Information

Published : 2022-08-26 09:15

Updated : 2022-08-31 13:02

NVD link : CVE-2021-3644

Mitre link : CVE-2021-3644

JSON object : View

CWE

NVD-CWE-noinfo

Products Affected

redhat

wildfly
descision_manager

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/wildfly/wildfly-core/commit/06dd9884f6ba50470b1fb5a35198a8784f037714", "name": "https://github.com/wildfly/wildfly-core/commit/06dd9884f6ba50470b1fb5a35198a8784f037714", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/wildfly/wildfly-core/commit/6d8db43cd43b5994b7a14003db978064e086090b", "name": "https://github.com/wildfly/wildfly-core/commit/6d8db43cd43b5994b7a14003db978064e086090b", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/security/cve/CVE-2021-3644", "name": "https://access.redhat.com/security/cve/CVE-2021-3644", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://github.com/wildfly/wildfly-core/pull/4668", "name": "https://github.com/wildfly/wildfly-core/pull/4668", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1976052", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1976052", "tags": ["Issue Tracking", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://issues.redhat.com/browse/WFCORE-5511", "name": "https://issues.redhat.com/browse/WFCORE-5511", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-3644", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.7}}, "publishedDate": "2022-08-26T16:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:wildfly:16.0.0:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:wildfly:17.0.0:beta2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-08-31T20:02Z"}

3.3 /10