Bug 1942693 (CVE-2021-3503)

Summary:	CVE-2021-3503 wildfly: Insufficient RBAC restrictions to metrics data
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, asoldano, atangrin, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dchen, dkreling, dosoudil, drieden, eleandro, etirelli, extras-orphan, fjuma, fnasser, ggaughan, gmalinko, gvarsami, ibek, iweiss, janstey, jason.greene, jboss-set, jcoleman, jochrist, jolee, jpallich, jperkins, jschatte, jstastny, jwon, kconner, krathod, kverlaen, kwills, ldimaggi, lef, lgao, loleary, lthon, mnovotny, msochure, msvehla, mszynkie, nwallace, pdrozd, peholase, pgallagh, pjindal, pmackay, puntogil, rguimara, rrajasek, rruss, rstancel, rsvoboda, rsynek, rwagner, sdaley, security-response-team, smaestri, spinder, sthorger, tcunning, theute, tkirby, tom.jenkinson, tzimanyi, yborgess
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Wildfly 23.0.1.Final	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-11 20:33:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1942695, 1950336, 2008216

Description Pedro Sampaio 2021-03-24 18:28:23 UTC

A flaw was found in Wildfly. When RBAC is enabled in that users are seeing more metrics data than they should.

References:

https://issues.redhat.com/browse/WFLY-11933

Comment 6 Product Security DevOps Team 2021-05-11 20:33:36 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3503