CVE-2023-4061
Estado: ModificadaMedia (6.5)—
A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.04%
- Percentil entre todas las CVEs puntuadas: 63
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-200
- NVD-CWE-noinfo
Referencias
- https://access.redhat.com/errata/RHSA-2023:5484
- https://access.redhat.com/errata/RHSA-2023:5485
- https://access.redhat.com/errata/RHSA-2023:5486
- https://access.redhat.com/errata/RHSA-2023:5488
- https://access.redhat.com/security/cve/CVE-2023-4061
- https://bugzilla.redhat.com/show_bug.cgi?id=2228608
- https://access.redhat.com/errata/RHSA-2023:5484
- https://access.redhat.com/errata/RHSA-2023:5485
- https://access.redhat.com/errata/RHSA-2023:5486
- https://access.redhat.com/errata/RHSA-2023:5488
- https://access.redhat.com/security/cve/CVE-2023-4061
- https://bugzilla.redhat.com/show_bug.cgi?id=2228608
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-4061",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-4061",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-04-26T20:01:33.866369Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform",
"versions": [
{
"status": "unaffected",
"version": "15.0.32.Final-redhat-00001",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "org.wildfly.core/wildfly-controller",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:7.4.13-8.GA_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.15.20-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-elytron",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:7.4.13-8.GA_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.15.20-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-elytron",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:7.4.13-8.GA_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.15.20-1.Final_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-elytron",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"packageName": "wildfly-core",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"defaultStatus": "unaffected"
}
]
}
],
"published": "2023-11-08T01:15:08.693",
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2023:5484",
"tags": [
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:5485",
"tags": [
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:5486",
"tags": [
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:5488",
"tags": [
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-4061",
"tags": [
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228608",
"tags": [
"Issue Tracking"
],
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:5484",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:5485",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:5486",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:5488",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-4061",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228608",
"tags": [
"Issue Tracking"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system."
},
{
"lang": "es",
"value": "Se encontró una falla en wildfly-core. Un usuario de administración podría usar la expresión de resolución en la interfaz HAL para leer posible información confidencial del sistema Wildfly. Este problema podría permitir que un usuario malintencionado acceda al sistema y obtenga posible información confidencial del sistema."
}
],
"lastModified": "2026-09-23T14:17:05.097",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8423D7F-3A8F-4AD8-BF51-245C9D8DD816"
},
{
"criteria": "cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9010FA7B-9055-4B63-A7DE-837C8D4F22FB",
"versionEndExcluding": "15.0.30"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "645A908C-18C2-4AB1-ACE7-3969E3A552A5"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "secalert@redhat.com"
}