CVE-2025-23367
Org.wildfly.core:wildfly-server: wildfly improper rbac permission
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Org.wildfly.core:wildfly-server: wildfly improper rbac permission
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
- Record
CVE-2025-23367- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-07
EUVDEUVD-2025-0214
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
- Record
EUVD-2025-0214- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
GitHub AdvisoriesGHSA-qr6x-62gq-4ccp
WildFly improper RBAC permission
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
Impact
Standalone server (Domain mode is not affected) with use access control enabled with RBAC provider can be suspended or resumed by unauthorized users. When a server is suspended, the server will stop receiving user requests. The resume handle does the opposite; it will cause a suspended server to start accepting user requests.
Patches
Fixed in WildFly Core 27.0.1.Final
Workarounds
No workaround available
References
See also: https://issues.redhat.com/browse/WFCORE-7153
Acknowledgements
The WildFly project would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue. https://www.gruppotim.it/it/footer/red-team.html
- Record
GHSA-qr6x-62gq-4ccp- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
- Record
CVE-2025-23367- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-05
OSV
Org.wildfly.core:wildfly-server: wildfly improper rbac permission
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
- Record
CVE-2025-23367- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-07
OSVGHSA-qr6x-62gq-4ccp
WildFly improper RBAC permission
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
Impact
Standalone server (Domain mode is not affected) with use access control enabled with RBAC provider can be suspended or resumed by unauthorized users. When a server is suspended, the server will stop receiving user requests. The resume handle does the opposite; it will cause a suspended server to start accepting user requests.
Patches
Fixed in WildFly Core 27.0.1.Final
Workarounds
No workaround available
References
See also: https://issues.redhat.com/browse/WFCORE-7153
Acknowledgements
The WildFly project would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue. https://www.gruppotim.it/it/footer/red-team.html
- Record
GHSA-qr6x-62gq-4ccp- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2025:3465
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.21 security update
- Record
RHSA-2025:3465- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:3989
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.7 security update
- Record
RHSA-2025:3989- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:3990
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.7 security update
- Record
RHSA-2025:3990- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-wildfly-2025-23367 No score
Org.wildfly.core:wildfly-server: wildfly improper rbac permission
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
- Record
BIT-wildfly-2025-23367- Updated
- 2026-11-02
OSVCLSA-2026-1780447845 No score
TuxCare security update for org.wildfly.core:wildfly-server (1 CVE)
TuxCare rebuilt org.wildfly.core:wildfly-server to address 1 CVE. Fixed in 19.0.1.Final-tuxcare.1.
- Record
CLSA-2026-1780447845- Updated
- 2026-11-02
Affected products
- redhat wildfly
- redhat jboss enterprise application platform
- red hat build of keycloak
- red hat data grid 8
- red hat fuse 7
- red hat jboss data grid 7
- red hat jboss enterprise application platform
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 7.4 for rhel 8
- red hat jboss enterprise application platform 7.4 for rhel 9
- red hat jboss enterprise application platform 7.4 on rhel 7
- red hat jboss enterprise application platform 7.4.22
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.wildfly.core:wildfly-serverMaven |
before 27.0.1.Final | 27.0.1.Final |
org.wildfly.core:wildfly-serverMaven |
28.0.0.Beta1 to 28.0.0.Beta1 | 28.0.0.Beta2 |
wildflyBitnami |
before 27.0.1, 28.0.0 up to 31.0.1 | 27.0.131.0.1 |
org.wildfly.core:wildfly-serverTuxCare:Maven |
19.0.1.Final up to 19.0.1.Final-tuxcare.1 | 19.0.1.Final-tuxcare.1 |
org.wildfly.core:wildfly-serverMaven |
before 27.0.1.Final, plus listed versions 1.0.0.Alpha11.0.0.Alpha101.0.0.Alpha111.0.0.Alpha121.0.0.Alpha13 Show 45 moreShow less1.0.0.Alpha141.0.0.Alpha151.0.0.Alpha161.0.0.Alpha171.0.0.Alpha181.0.0.Alpha191.0.0.Alpha21.0.0.Alpha31.0.0.Alpha41.0.0.Alpha51.0.0.Alpha61.0.0.Alpha71.0.0.Alpha81.0.0.Alpha91.0.0.Beta11.0.0.Beta21.0.0.Beta31.0.0.Beta41.0.0.Beta51.0.0.Beta61.0.0.CR11.0.0.CR21.0.0.CR31.0.0.CR41.0.0.CR51.0.0.CR61.0.0.CR71.0.0.Final1.0.1.Final1.0.2.Final10.0.0.Beta110.0.0.Beta210.0.0.Beta310.0.0.Beta410.0.0.Beta510.0.0.Beta610.0.0.Beta710.0.0.Beta810.0.0.Beta910.0.0.CR110.0.0.Final10.0.2.Final10.0.3.Final11.0.0.Beta111.0.0.Beta10 |
27.0.1.Final |
org.wildfly.core:wildfly-serverMaven |
28.0.0.Beta1 up to 28.0.0.Beta2 | 28.0.0.Beta2 |
eap8-apache-commons-ioRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:2.16.1-1.redhat_00001.1.el8eap | 0:2.16.1-1.redhat_00001.1.el8eap |
eap8-bouncycastleRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el8eap | 0:1.80.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-jmailRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el8eap | 0:1.80.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-pgRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el8eap | 0:1.80.0-1.redhat_00001.1.el8eap |
Show 74 moreShow less
| Package | Affected | Fixed |
|---|---|---|
eap8-bouncycastle-pkixRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el8eap | 0:1.80.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-provRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el8eap | 0:1.80.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-utilRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el8eap | 0:1.80.0-1.redhat_00001.1.el8eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:800.7.0-2.GA_redhat_00002.1.el8eap | 0:800.7.0-2.GA_redhat_00002.1.el8eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:800.7.0-2.GA_redhat_00002.1.el8eap | 0:800.7.0-2.GA_redhat_00002.1.el8eap |
eap8-hibernateRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:6.2.35-1.Final_redhat_00001.1.el8eap | 0:6.2.35-1.Final_redhat_00001.1.el8eap |
eap8-hibernate-coreRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:6.2.35-1.Final_redhat_00001.1.el8eap | 0:6.2.35-1.Final_redhat_00001.1.el8eap |
eap8-hibernate-enversRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:6.2.35-1.Final_redhat_00001.1.el8eap | 0:6.2.35-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamarRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el8eap | 0:3.0.13-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el8eap | 0:3.0.13-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el8eap | 0:3.0.13-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el8eap | 0:3.0.13-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el8eap | 0:3.0.13-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el8eap | 0:3.0.13-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el8eap | 0:3.0.13-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el8eap | 0:3.0.13-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el8eap | 0:3.0.13-1.Final_redhat_00001.1.el8eap |
eap8-jakarta-enterprise-concurrentRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.0.1-1.redhat_00001.1.el8eap | 0:3.0.1-1.redhat_00001.1.el8eap |
eap8-jsf-implRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:4.0.11-1.redhat_00001.1.el8eap | 0:4.0.11-1.redhat_00001.1.el8eap |
eap8-reactive-streamsRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:1.0.4-3.redhat_00004.1.el8eap | 0:1.0.4-3.redhat_00004.1.el8eap |
eap8-reactivex-rxjavaRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:3.1.10-1.redhat_00001.1.el8eap | 0:3.1.10-1.redhat_00001.1.el8eap |
eap8-weld-coreRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el8eap | 0:5.1.5-1.Final_redhat_00001.1.el8eap |
eap8-weld-core-implRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el8eap | 0:5.1.5-1.Final_redhat_00001.1.el8eap |
eap8-weld-core-jsfRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el8eap | 0:5.1.5-1.Final_redhat_00001.1.el8eap |
eap8-weld-ejbRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el8eap | 0:5.1.5-1.Final_redhat_00001.1.el8eap |
eap8-weld-jtaRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el8eap | 0:5.1.5-1.Final_redhat_00001.1.el8eap |
eap8-weld-lite-extension-translatorRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el8eap | 0:5.1.5-1.Final_redhat_00001.1.el8eap |
eap8-weld-webRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el8eap | 0:5.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:8.0.7-3.GA_redhat_00004.1.el8eap | 0:8.0.7-3.GA_redhat_00004.1.el8eap |
eap8-wildfly-elytronRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:2.2.9-1.Final_redhat_00001.1.el8eap | 0:2.2.9-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-elytron-toolRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:2.2.9-1.Final_redhat_00001.1.el8eap | 0:2.2.9-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-java-jdk11Red Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:8.0.7-3.GA_redhat_00004.1.el8eap | 0:8.0.7-3.GA_redhat_00004.1.el8eap |
eap8-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:8.0.7-3.GA_redhat_00004.1.el8eap | 0:8.0.7-3.GA_redhat_00004.1.el8eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:8.0.7-3.GA_redhat_00004.1.el8eap | 0:8.0.7-3.GA_redhat_00004.1.el8eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 2 CVEs |
before 0:8.0.7-3.GA_redhat_00004.1.el8eap | 0:8.0.7-3.GA_redhat_00004.1.el8eap |
eap8-apache-commons-ioRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:2.16.1-1.redhat_00001.1.el9eap | 0:2.16.1-1.redhat_00001.1.el9eap |
eap8-bouncycastleRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el9eap | 0:1.80.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-jmailRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el9eap | 0:1.80.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-pgRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el9eap | 0:1.80.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-pkixRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el9eap | 0:1.80.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-provRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el9eap | 0:1.80.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-utilRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:1.80.0-1.redhat_00001.1.el9eap | 0:1.80.0-1.redhat_00001.1.el9eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:800.7.0-2.GA_redhat_00002.1.el9eap | 0:800.7.0-2.GA_redhat_00002.1.el9eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:800.7.0-2.GA_redhat_00002.1.el9eap | 0:800.7.0-2.GA_redhat_00002.1.el9eap |
eap8-hibernateRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:6.2.35-1.Final_redhat_00001.1.el9eap | 0:6.2.35-1.Final_redhat_00001.1.el9eap |
eap8-hibernate-coreRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:6.2.35-1.Final_redhat_00001.1.el9eap | 0:6.2.35-1.Final_redhat_00001.1.el9eap |
eap8-hibernate-enversRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:6.2.35-1.Final_redhat_00001.1.el9eap | 0:6.2.35-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamarRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el9eap | 0:3.0.13-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el9eap | 0:3.0.13-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el9eap | 0:3.0.13-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el9eap | 0:3.0.13-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el9eap | 0:3.0.13-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el9eap | 0:3.0.13-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el9eap | 0:3.0.13-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el9eap | 0:3.0.13-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.0.13-1.Final_redhat_00001.1.el9eap | 0:3.0.13-1.Final_redhat_00001.1.el9eap |
eap8-jakarta-enterprise-concurrentRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.0.1-1.redhat_00001.1.el9eap | 0:3.0.1-1.redhat_00001.1.el9eap |
eap8-jsf-implRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:4.0.11-1.redhat_00001.1.el9eap | 0:4.0.11-1.redhat_00001.1.el9eap |
eap8-reactive-streamsRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:1.0.4-3.redhat_00004.1.el9eap | 0:1.0.4-3.redhat_00004.1.el9eap |
eap8-reactivex-rxjavaRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:3.1.10-1.redhat_00001.1.el9eap | 0:3.1.10-1.redhat_00001.1.el9eap |
eap8-weld-coreRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el9eap | 0:5.1.5-1.Final_redhat_00001.1.el9eap |
eap8-weld-core-implRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el9eap | 0:5.1.5-1.Final_redhat_00001.1.el9eap |
eap8-weld-core-jsfRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el9eap | 0:5.1.5-1.Final_redhat_00001.1.el9eap |
eap8-weld-ejbRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el9eap | 0:5.1.5-1.Final_redhat_00001.1.el9eap |
eap8-weld-jtaRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el9eap | 0:5.1.5-1.Final_redhat_00001.1.el9eap |
eap8-weld-lite-extension-translatorRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el9eap | 0:5.1.5-1.Final_redhat_00001.1.el9eap |
eap8-weld-webRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:5.1.5-1.Final_redhat_00001.1.el9eap | 0:5.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:8.0.7-3.GA_redhat_00004.1.el9eap | 0:8.0.7-3.GA_redhat_00004.1.el9eap |
eap8-wildfly-elytronRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:2.2.9-1.Final_redhat_00001.1.el9eap | 0:2.2.9-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-elytron-toolRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:2.2.9-1.Final_redhat_00001.1.el9eap | 0:2.2.9-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-java-jdk11Red Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:8.0.7-3.GA_redhat_00004.1.el9eap | 0:8.0.7-3.GA_redhat_00004.1.el9eap |
eap8-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:8.0.7-3.GA_redhat_00004.1.el9eap | 0:8.0.7-3.GA_redhat_00004.1.el9eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:8.0.7-3.GA_redhat_00004.1.el9eap | 0:8.0.7-3.GA_redhat_00004.1.el9eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 2 CVEs |
before 0:8.0.7-3.GA_redhat_00004.1.el9eap | 0:8.0.7-3.GA_redhat_00004.1.el9eap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | NVD, OSV | |
| facts | CVE List, EUVD | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-23367 is a medium vulnerability (CVSS 6.5) in Redhat Wildfly, published January 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in org.wildfly.core:wildfly-server 27.0.1.Final.
References
access.redhat.com/errata/RHSA-2025:3465
Show 62 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2337620
github.com/advisories/GHSA-qr6x-62gq-4ccp
nvd.nist.gov/vuln/detail/CVE-2025-23367
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3465.json
cve.org/CVERecord?id=CVE-2024-47535
issues.redhat.com/browse/JBEAP-28382
Left out here: 342 versions. The JSON record has them.