« Volver al listado

CVE-2021-3536

Estado: ModificadaMedia (4.8)—

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (9)

Redhat — Build OF QuarkusRedhat — Data GridRedhat — Descision ManagerRedhat — Integration Camel KRedhat — Integration Camel QuarkusRedhat — Integration Service RegistryRedhat — Jboss A-mqRedhat — Jboss Enterprise Application PlatformRedhat — Wildfly

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-3536",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "wildfly",
          "versions": [
            {
              "status": "affected",
              "version": "Wildfly 23.0.2.Final"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-05-20T13:15:07.840",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1948001",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1948001",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity."
    },
    {
      "lang": "es",
      "value": "Se encontró un fallo en Wildfly en versiones anteriores a 23.0.2.Final, mientras se crea un nuevo rol en el modo de dominio por medio de la consola de administración, es posible agregar una carga útil en el campo name, conllevando a una vulnerabilidad de tipo XSS. Esto afecta la Confidencialidad y la Integridad"
    }
  ],
  "lastModified": "2026-06-17T04:05:18.450",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE29B9D6-63DC-4779-ACE8-4E51E6A0AF37"
            },
            {
              "criteria": "cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7095200A-4DAC-4433-99E8-86CA88E1E4D4"
            },
            {
              "criteria": "cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5863BBF-829E-44EF-ACE8-61D5037251F6"
            },
            {
              "criteria": "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B87C8AD3-8878-4546-86C2-BF411876648C"
            },
            {
              "criteria": "cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F039C746-2001-4EE5-835F-49607A94F12B"
            },
            {
              "criteria": "cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF03BDE8-602D-4DEE-BA5B-5B20FDF47741"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A58966CB-36AF-4E64-AB39-BE3A0753E155"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88BF3B2C-B121-483A-AEF2-8082F6DA5310"
            },
            {
              "criteria": "cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92A58DE6-0DDA-4A87-B1F6-56499CE7114A",
              "versionEndExcluding": "23.0.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}