CVE-2023-4061
CVE-2023-4061: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2023-4061] Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor
CVE-2023-4061Source published Source updated
A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This vulnerability requires a malicious user to previously have access to the system, especially access to the HAL interface via browser and logged with a management user who have access to the resolve-expression method, hence the moderate impact. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-200. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9; Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7. Red Hat fixing…
- Affected products in this advisory
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- org.wildfly.core/wildfly-controller:15.0.32.Final-redhat-00001
- eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap
- eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap
- eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap
7 more entries in the full advisory.
- Mitigation guidance
- Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.