CVE-2021-3503
Metrics exposure in Wildfly
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
- Record
CVE-2021-3503- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
- Record
CVE-2021-3503- Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2022-1702 No score
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
- Record
EUVD-2022-1702- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c4r5-xvgw-2942
Metrics exposure in Wildfly
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data.
- Record
GHSA-c4r5-xvgw-2942- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
- Record
CVE-2021-3503- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-c4r5-xvgw-2942
Metrics exposure in Wildfly
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data.
- Record
GHSA-c4r5-xvgw-2942- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVBIT-wildfly-2021-3503 No score
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
- Record
BIT-wildfly-2021-3503- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.wildfly:wildfly-metricsMaven |
through 23.0.0.Final | 23.0.1.Final |
wildflyBitnami |
before 23.0.1 | 23.0.1 |
org.wildfly:wildfly-metricsMaven |
before 23.0.1.Final, plus listed versions 22.0.0.Beta122.0.0.Final22.0.1.Final23.0.0.Beta123.0.0.Final |
23.0.1.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3503 is a medium vulnerability (CVSS 4.3) in Red Hat Wildfly, published April 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in org.wildfly:wildfly-metrics 23.0.1.Final.
References
bugzilla.redhat.com/show_bug.cgi?id=1942693
issues.redhat.com/browse/WFLY-11933
github.com/wildfly/wildfly/pull/14136
access.redhat.com/security/cve/CVE-2021-3503
nvd.nist.gov/vuln/detail/CVE-2021-3503
security.netapp.com/advisory/ntap-20220609-0004