CoreCVE
Back

MEDIUM

Org.wildfly.core:wildfly-server: wildfly improper rbac permission

Published Jan 30, 2025

Description

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Affected products

Remediation

Vendor solution

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Red Hat statement

Red Hat has evaluated this issue and the attacker must be authenticated as a user that belongs to the "Monitor" or "Auditor" management groups. It requires previous privileges to jeopardize an environment.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-284

References (15)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Jan 30, 2025
Updated Sep 17, 2026
Reserved Jan 14, 2025
Link CVE-2025-23367
CISA Vulnrichment
Updated Jan 30, 2025
NVD
Status Modified
Modified Sep 18, 2026
Link CVE-2025-23367
Red Hat
Severity Moderate
Public date Jan 30, 2025
Links CVE-2025-23367 - Bugzilla
GHSA-QR6X-62GQ-4CCP