title: Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor
description: A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.
problem types: Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
product: wildfly-core
vendor: n/a
versions:
version: 15.0.30.Final, status: unaffected
}
{
vendor: Red Hat
product: EAP 7.4.13
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: wildfly-core
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.13-8.GA_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly-elytron
defaultStatus: affected
versions:
version: 0:1.15.20-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.13-8.GA_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly-elytron
defaultStatus: affected
versions:
version: 0:1.15.20-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.13-8.GA_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly-elytron
defaultStatus: affected
versions:
version: 0:1.15.20-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: wildfly-core
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]
workarounds: Wildfly administrators are recommended to use Vault, especially the Elytron subsystem, to store potential critical information such as DNS, IPs, and credentials.