CVE-2021-3536
Medium
Description
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
SeverityMedium
CVSS4.8
Exploit probability—
Product
Redhat Wildfly
PublishedMay 20, 2021
First seenMay 20, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- redhat wildfly23.0.2 or later
- org.wildfly:wildfly-parent23.0.2.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat wildfly | v < 23.0.2 | 23.0.2 |
| redhat build_of_quarkus | No range specified | — |
| redhat data_grid | 8.0 | — |
| redhat descision_manager | 7.0 | — |
| redhat integration_camel_k | No range specified | — |
| redhat integration_camel_quarkus | No range specified | — |
| redhat integration_service_registry | No range specified | — |
| redhat jboss_a-mq | 7 | — |
| redhat jboss_enterprise_application_platform | 7.0 | — |
| org.wildfly:wildfly-parentMaven | v < 23.0.2.Final | 23.0.2.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.