SB2023101243 - Multiple vulnerabilities in Wildfly Core

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-4061)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to improper privilege management in the RBAC implementation. A remote user can use the resolve-expression in the HAL interface to read system properties from the Wildfly system.

2) Link following (CVE-ID: CVE-2023-4759)

The vulnerability allows a remote attacker to overwrite files on the system.

The vulnerability exists due to an insecure link following. A remote attacker can place a specially crafted symbolic link into the repository, trick the victim into cloning it and overwrite arbitrary files on the system.

Remediation

Install update from vendor's website.

References

• https://github.com/wildfly/wildfly-core/releases/tag/22.0.0.Final
• https://bugzilla.redhat.com/show_bug.cgi?id=2228608