CVE-2025-23367

Katalog CVE

CVSS 6.5 · Medium EPSS 0,77%

Kerentanan Improper Access Control pada redhat jboss enterprise application platform, redhat wildfly. Skor CVSS 3.1 6.5 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Rincian

Terbit di NVD

30 Januari 2025

Terakhir diubah

18 September 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2025-23367 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2337620 advisory vendor
• https://github.com/advisories/GHSA-qr6x-62gq-4ccp advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2025:3465
• https://access.redhat.com/errata/RHSA-2025:3467 issue tracking
• https://access.redhat.com/errata/RHSA-2025:3989 issue tracking
• https://access.redhat.com/errata/RHSA-2025:3990
• https://access.redhat.com/errata/RHSA-2025:3992
• https://access.redhat.com/errata/RHSA-2025:4552