CVE-2025-23367
Description
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
How to fix
- redhat wildfly27.0.1 or later
- redhat jboss_enterprise_application_platform7.4.21, 8.0.7 or later
- org.wildfly.core:wildfly-server27.0.1.Final, 28.0.0.Beta2 or later
- access.redhat.com/security/cve/CVE-2025-23367
- bugzilla.redhat.com/show_bug.cgi?id=2337620
- access.redhat.com/errata/RHSA-2025:3465
- access.redhat.com/errata/RHSA-2025:3467
- access.redhat.com/errata/RHSA-2025:3989
- access.redhat.com/errata/RHSA-2025:3990
- access.redhat.com/errata/RHSA-2025:3992
- access.redhat.com/errata/RHSA-2025:4552
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat wildfly | v < 27.0.1, 28.0.0 | 27.0.1 |
| redhat jboss_enterprise_application_platform | 7.4 ≤ v < 7.4.21, 8.0.0 ≤ v < 8.0.7 | 7.4.21, 8.0.7 |
| org.wildfly.core:wildfly-serverMaven | v < 27.0.1.Final, 28.0.0.Beta1 ≤ v < 28.0.0.Beta2 | 27.0.1.Final, 28.0.0.Beta2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.