CVE-2025-23367

Published: Jan 30, 2025

Modified: Apr 30, 2026

PUBLISHED

CVSS v3.1

6.5

MEDIUM

Description

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Vendor	Product	Versions
Unknown	wildfly-core	affected `0 - < 27.0.1.Final` affected `28.0.0.Beta1 - < 28.0.0.Beta2`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	unaffected `0:4.1.119-1.Final_redhat_00004.1.el8eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	unaffected `0:4.1.119-1.Final_redhat_00004.1.el8eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	unaffected `0:7.4.21-3.GA_29548_redhat_00001.1.el8eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	unaffected `0:4.1.119-1.Final_redhat_00004.1.el9eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	unaffected `0:4.1.119-1.Final_redhat_00004.1.el9eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	unaffected `0:7.4.21-3.GA_29548_redhat_00001.1.el9eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7	unaffected `0:4.1.119-1.Final_redhat_00004.1.el7eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7	unaffected `0:4.1.119-1.Final_redhat_00004.1.el7eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7	unaffected `0:7.4.21-3.GA_29548_redhat_00001.1.el7eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 8	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	unaffected `0:8.0.7-3.GA_redhat_00004.1.el8eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	unaffected `0:8.0.7-3.GA_redhat_00004.1.el9eap - < *`
Red Hat	Red Hat Build of Keycloak	All versions
Red Hat	Red Hat Data Grid 8	All versions
Red Hat	Red Hat Fuse 7	All versions
Red Hat	Red Hat JBoss Data Grid 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	All versions
Red Hat	Red Hat Process Automation 7	All versions
Red Hat	Red Hat Single Sign-On 7	All versions