Every CVE Search/ Get API key

CVE-2025-23367

Org.wildfly.core:wildfly-server: wildfly improper rbac permission

6.5 MediumFix available

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.77%Up 0.7 points since Jan 31, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

Org.wildfly.core:wildfly-server: wildfly improper rbac permission

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Record
CVE-2025-23367
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-284
Updated
2026-11-05
EUVDEUVD-2025-0214 6.5

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Record
EUVD-2025-0214
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-qr6x-62gq-4ccp 6.5

WildFly improper RBAC permission

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Impact

Standalone server (Domain mode is not affected) with use access control enabled with RBAC provider can be suspended or resumed by unauthorized users. When a server is suspended, the server will stop receiving user requests. The resume handle does the opposite; it will cause a suspended server to start accepting user requests.

Patches

Fixed in WildFly Core 27.0.1.Final

Workarounds

No workaround available

References

See also: https://issues.redhat.com/browse/WFCORE-7153

Acknowledgements

The WildFly project would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue. https://www.gruppotim.it/it/footer/red-team.html

Record
GHSA-qr6x-62gq-4ccp
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-284
Updated
2026-11-02
NVD 6.5

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Record
CVE-2025-23367
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-284
Updated
2026-11-05
OSV 6.5

Org.wildfly.core:wildfly-server: wildfly improper rbac permission

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Record
CVE-2025-23367
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-284
Updated
2026-11-05
OSVGHSA-qr6x-62gq-4ccp 6.5

WildFly improper RBAC permission

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Impact

Standalone server (Domain mode is not affected) with use access control enabled with RBAC provider can be suspended or resumed by unauthorized users. When a server is suspended, the server will stop receiving user requests. The resume handle does the opposite; it will cause a suspended server to start accepting user requests.

Patches

Fixed in WildFly Core 27.0.1.Final

Workarounds

No workaround available

References

See also: https://issues.redhat.com/browse/WFCORE-7153

Acknowledgements

The WildFly project would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue. https://www.gruppotim.it/it/footer/red-team.html

Record
GHSA-qr6x-62gq-4ccp
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-284
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2025:3465 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.21 security update

Record
RHSA-2025:3465
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:3989 6.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.7 security update

Record
RHSA-2025:3989
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:3990 6.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.7 security update

Record
RHSA-2025:3990
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-wildfly-2025-23367 No score

Org.wildfly.core:wildfly-server: wildfly improper rbac permission

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Record
BIT-wildfly-2025-23367
Updated
2026-11-02
OSVCLSA-2026-1780447845 No score

TuxCare security update for org.wildfly.core:wildfly-server (1 CVE)

TuxCare rebuilt org.wildfly.core:wildfly-server to address 1 CVE. Fixed in 19.0.1.Final-tuxcare.1.

Record
CLSA-2026-1780447845
Updated
2026-11-02

Affected products

Show 6 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
org.wildfly.core:wildfly-server
Maven
 before 27.0.1.Final
27.0.1.Final
org.wildfly.core:wildfly-server
Maven
 28.0.0.Beta1 to 28.0.0.Beta1
28.0.0.Beta2
wildfly
Bitnami
 before 27.0.1, 28.0.0 up to 31.0.1
27.0.131.0.1
org.wildfly.core:wildfly-server
TuxCare:Maven
 19.0.1.Final up to 19.0.1.Final-tuxcare.1
19.0.1.Final-tuxcare.1
org.wildfly.core:wildfly-server
Maven
 before 27.0.1.Final, plus listed versions
1.0.0.Alpha11.0.0.Alpha101.0.0.Alpha111.0.0.Alpha121.0.0.Alpha13
Show 45 moreShow less
1.0.0.Alpha141.0.0.Alpha151.0.0.Alpha161.0.0.Alpha171.0.0.Alpha181.0.0.Alpha191.0.0.Alpha21.0.0.Alpha31.0.0.Alpha41.0.0.Alpha51.0.0.Alpha61.0.0.Alpha71.0.0.Alpha81.0.0.Alpha91.0.0.Beta11.0.0.Beta21.0.0.Beta31.0.0.Beta41.0.0.Beta51.0.0.Beta61.0.0.CR11.0.0.CR21.0.0.CR31.0.0.CR41.0.0.CR51.0.0.CR61.0.0.CR71.0.0.Final1.0.1.Final1.0.2.Final10.0.0.Beta110.0.0.Beta210.0.0.Beta310.0.0.Beta410.0.0.Beta510.0.0.Beta610.0.0.Beta710.0.0.Beta810.0.0.Beta910.0.0.CR110.0.0.Final10.0.2.Final10.0.3.Final11.0.0.Beta111.0.0.Beta10
27.0.1.Final
org.wildfly.core:wildfly-server
Maven
 28.0.0.Beta1 up to 28.0.0.Beta2
28.0.0.Beta2
eap8-apache-commons-io
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:2.16.1-1.redhat_00001.1.el8eap
0:2.16.1-1.redhat_00001.1.el8eap
eap8-bouncycastle
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el8eap
0:1.80.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-jmail
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el8eap
0:1.80.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-pg
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el8eap
0:1.80.0-1.redhat_00001.1.el8eap
Show 74 moreShow less
Affected packages
PackageAffectedFixed
eap8-bouncycastle-pkix
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el8eap
0:1.80.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-prov
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el8eap
0:1.80.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-util
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el8eap
0:1.80.0-1.redhat_00001.1.el8eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:800.7.0-2.GA_redhat_00002.1.el8eap
0:800.7.0-2.GA_redhat_00002.1.el8eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:800.7.0-2.GA_redhat_00002.1.el8eap
0:800.7.0-2.GA_redhat_00002.1.el8eap
eap8-hibernate
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:6.2.35-1.Final_redhat_00001.1.el8eap
0:6.2.35-1.Final_redhat_00001.1.el8eap
eap8-hibernate-core
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:6.2.35-1.Final_redhat_00001.1.el8eap
0:6.2.35-1.Final_redhat_00001.1.el8eap
eap8-hibernate-envers
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:6.2.35-1.Final_redhat_00001.1.el8eap
0:6.2.35-1.Final_redhat_00001.1.el8eap
eap8-ironjacamar
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el8eap
0:3.0.13-1.Final_redhat_00001.1.el8eap
eap8-ironjacamar-common-api
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el8eap
0:3.0.13-1.Final_redhat_00001.1.el8eap
eap8-ironjacamar-common-impl
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el8eap
0:3.0.13-1.Final_redhat_00001.1.el8eap
eap8-ironjacamar-common-spi
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el8eap
0:3.0.13-1.Final_redhat_00001.1.el8eap
eap8-ironjacamar-core-api
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el8eap
0:3.0.13-1.Final_redhat_00001.1.el8eap
eap8-ironjacamar-core-impl
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el8eap
0:3.0.13-1.Final_redhat_00001.1.el8eap
eap8-ironjacamar-deployers-common
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el8eap
0:3.0.13-1.Final_redhat_00001.1.el8eap
eap8-ironjacamar-jdbc
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el8eap
0:3.0.13-1.Final_redhat_00001.1.el8eap
eap8-ironjacamar-validator
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el8eap
0:3.0.13-1.Final_redhat_00001.1.el8eap
eap8-jakarta-enterprise-concurrent
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.0.1-1.redhat_00001.1.el8eap
0:3.0.1-1.redhat_00001.1.el8eap
eap8-jsf-impl
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:4.0.11-1.redhat_00001.1.el8eap
0:4.0.11-1.redhat_00001.1.el8eap
eap8-reactive-streams
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:1.0.4-3.redhat_00004.1.el8eap
0:1.0.4-3.redhat_00004.1.el8eap
eap8-reactivex-rxjava
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:3.1.10-1.redhat_00001.1.el8eap
0:3.1.10-1.redhat_00001.1.el8eap
eap8-weld-core
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el8eap
0:5.1.5-1.Final_redhat_00001.1.el8eap
eap8-weld-core-impl
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el8eap
0:5.1.5-1.Final_redhat_00001.1.el8eap
eap8-weld-core-jsf
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el8eap
0:5.1.5-1.Final_redhat_00001.1.el8eap
eap8-weld-ejb
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el8eap
0:5.1.5-1.Final_redhat_00001.1.el8eap
eap8-weld-jta
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el8eap
0:5.1.5-1.Final_redhat_00001.1.el8eap
eap8-weld-lite-extension-translator
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el8eap
0:5.1.5-1.Final_redhat_00001.1.el8eap
eap8-weld-web
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el8eap
0:5.1.5-1.Final_redhat_00001.1.el8eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:8.0.7-3.GA_redhat_00004.1.el8eap
0:8.0.7-3.GA_redhat_00004.1.el8eap
eap8-wildfly-elytron
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:2.2.9-1.Final_redhat_00001.1.el8eap
0:2.2.9-1.Final_redhat_00001.1.el8eap
eap8-wildfly-elytron-tool
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:2.2.9-1.Final_redhat_00001.1.el8eap
0:2.2.9-1.Final_redhat_00001.1.el8eap
eap8-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:8.0.7-3.GA_redhat_00004.1.el8eap
0:8.0.7-3.GA_redhat_00004.1.el8eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:8.0.7-3.GA_redhat_00004.1.el8eap
0:8.0.7-3.GA_redhat_00004.1.el8eap
eap8-wildfly-java-jdk21
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:8.0.7-3.GA_redhat_00004.1.el8eap
0:8.0.7-3.GA_redhat_00004.1.el8eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 2 CVEs
 before 0:8.0.7-3.GA_redhat_00004.1.el8eap
0:8.0.7-3.GA_redhat_00004.1.el8eap
eap8-apache-commons-io
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:2.16.1-1.redhat_00001.1.el9eap
0:2.16.1-1.redhat_00001.1.el9eap
eap8-bouncycastle
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el9eap
0:1.80.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-jmail
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el9eap
0:1.80.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-pg
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el9eap
0:1.80.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-pkix
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el9eap
0:1.80.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-prov
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el9eap
0:1.80.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-util
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:1.80.0-1.redhat_00001.1.el9eap
0:1.80.0-1.redhat_00001.1.el9eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:800.7.0-2.GA_redhat_00002.1.el9eap
0:800.7.0-2.GA_redhat_00002.1.el9eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:800.7.0-2.GA_redhat_00002.1.el9eap
0:800.7.0-2.GA_redhat_00002.1.el9eap
eap8-hibernate
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:6.2.35-1.Final_redhat_00001.1.el9eap
0:6.2.35-1.Final_redhat_00001.1.el9eap
eap8-hibernate-core
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:6.2.35-1.Final_redhat_00001.1.el9eap
0:6.2.35-1.Final_redhat_00001.1.el9eap
eap8-hibernate-envers
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:6.2.35-1.Final_redhat_00001.1.el9eap
0:6.2.35-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el9eap
0:3.0.13-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar-common-api
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el9eap
0:3.0.13-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar-common-impl
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el9eap
0:3.0.13-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar-common-spi
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el9eap
0:3.0.13-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar-core-api
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el9eap
0:3.0.13-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar-core-impl
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el9eap
0:3.0.13-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar-deployers-common
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el9eap
0:3.0.13-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar-jdbc
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el9eap
0:3.0.13-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar-validator
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.0.13-1.Final_redhat_00001.1.el9eap
0:3.0.13-1.Final_redhat_00001.1.el9eap
eap8-jakarta-enterprise-concurrent
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.0.1-1.redhat_00001.1.el9eap
0:3.0.1-1.redhat_00001.1.el9eap
eap8-jsf-impl
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:4.0.11-1.redhat_00001.1.el9eap
0:4.0.11-1.redhat_00001.1.el9eap
eap8-reactive-streams
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:1.0.4-3.redhat_00004.1.el9eap
0:1.0.4-3.redhat_00004.1.el9eap
eap8-reactivex-rxjava
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:3.1.10-1.redhat_00001.1.el9eap
0:3.1.10-1.redhat_00001.1.el9eap
eap8-weld-core
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el9eap
0:5.1.5-1.Final_redhat_00001.1.el9eap
eap8-weld-core-impl
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el9eap
0:5.1.5-1.Final_redhat_00001.1.el9eap
eap8-weld-core-jsf
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el9eap
0:5.1.5-1.Final_redhat_00001.1.el9eap
eap8-weld-ejb
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el9eap
0:5.1.5-1.Final_redhat_00001.1.el9eap
eap8-weld-jta
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el9eap
0:5.1.5-1.Final_redhat_00001.1.el9eap
eap8-weld-lite-extension-translator
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el9eap
0:5.1.5-1.Final_redhat_00001.1.el9eap
eap8-weld-web
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:5.1.5-1.Final_redhat_00001.1.el9eap
0:5.1.5-1.Final_redhat_00001.1.el9eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:8.0.7-3.GA_redhat_00004.1.el9eap
0:8.0.7-3.GA_redhat_00004.1.el9eap
eap8-wildfly-elytron
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:2.2.9-1.Final_redhat_00001.1.el9eap
0:2.2.9-1.Final_redhat_00001.1.el9eap
eap8-wildfly-elytron-tool
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:2.2.9-1.Final_redhat_00001.1.el9eap
0:2.2.9-1.Final_redhat_00001.1.el9eap
eap8-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:8.0.7-3.GA_redhat_00004.1.el9eap
0:8.0.7-3.GA_redhat_00004.1.el9eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:8.0.7-3.GA_redhat_00004.1.el9eap
0:8.0.7-3.GA_redhat_00004.1.el9eap
eap8-wildfly-java-jdk21
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:8.0.7-3.GA_redhat_00004.1.el9eap
0:8.0.7-3.GA_redhat_00004.1.el9eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 2 CVEs
 before 0:8.0.7-3.GA_redhat_00004.1.el9eap
0:8.0.7-3.GA_redhat_00004.1.el9eap

History

History
RecordedChangedSources
affectedNVD, OSV
factsCVE List, EUVD
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-23367 is a medium vulnerability (CVSS 6.5) in Redhat Wildfly, published January 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in org.wildfly.core:wildfly-server 27.0.1.Final.

References

Show 62 moreShow less
This page doesn't list everything

Left out here: 342 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open