CVE-2021-3644

LOW

Redhat Descision Manager < 16.0.1.Final - Information Disclosure

Title source: rule
STIX 2.1

Description

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.

References (6)

Core 6
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1976052
Vendor Advisory x_refsource_misc
https://access.redhat.com/security/cve/CVE-2021-3644
Patch, Vendor Advisory x_refsource_misc
https://issues.redhat.com/browse/WFCORE-5511
Patch, Third Party Advisory x_refsource_misc
https://github.com/wildfly/wildfly-core/pull/4668

Scores

CVSS v3 3.3
EPSS 0.0044
EPSS Percentile 63.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Details

CWE
CWE-200
Status published
Products (4)
org.wildfly.core/wildfly-server 0 - 16.0.1.FinalMaven
redhat/descision_manager 7.0
redhat/wildfly 16.0.0
redhat/wildfly 17.0.0 beta2
Published Aug 26, 2022
Tracked Since Feb 18, 2026