Improper access control in Wildfly - CVE-2025-23367

Vulnerability identifier: #VU106929

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-23367

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the Wildfly Server Role Based Access Control (RBAC) provider. A remote user can bypass implemented security restrictions and suspend or resume the server.

Wildfly
JBoss Enterprise Application Platform
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-apache-commons-io (Red Hat package)
eap7-weld-core (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)

Install updates from vendor's website.

Wildfly - update to 27.0.1
JBoss Enterprise Application Platform - addressed in versions 7.4.21, 7.4.22
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.19-1.Final_redhat_00001.1.el7eap, 1.5.19-1.Final_redhat_00001.1.el8eap, 1.5.19-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-41.Final_redhat_00041.1.el7eap, 1.10.0-41.Final_redhat_00041.1.el8eap, 1.10.0-41.Final_redhat_00041.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.25-1.Final_redhat_00001.1.el7eap, 1.15.25-1.Final_redhat_00001.1.el8eap, 1.15.25-1.Final_redhat_00001.1.el9eap
eap7-apache-commons-io (Red Hat package) - addressed in versions 2.16.1-1.redhat_00001.1.el7eap, 2.16.1-1.redhat_00001.1.el8eap, 2.16.1-1.redhat_00001.1.el9eap
eap7-weld-core (Red Hat package) - addressed in versions 3.1.11-1.Final_redhat_00001.1.el7eap, 3.1.11-1.Final_redhat_00001.1.el8eap, 3.1.11-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.26-1.Final_redhat_00001.1.el7eap, 3.3.26-1.Final_redhat_00001.1.el8eap, 3.3.26-1.Final_redhat_00001.1.el9eap
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.31-1.Final_redhat_00001.1.el7eap, 5.0.31-1.Final_redhat_00001.1.el8eap, 5.0.31-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.4.22-2.GA_redhat_00001.1.el7eap, 7.4.22-2.GA_redhat_00001.1.el8eap, 7.4.22-2.GA_redhat_00001.1.el9eap

• https://bugzilla.redhat.com/show_bug.cgi?id=2337620
• https://github.com/advisories/GHSA-qr6x-62gq-4ccp

• Improper access control in Wildfly Server
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4