Bug 1636014 (CVE-2018-10683) - CVE-2018-10683 wildfly: Missing authentication in edfault installation without a security realm reference
Summary: CVE-2018-10683 wildfly: Missing authentication in edfault installation withou...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2018-10683
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1534478
TreeView+ depends on / blocked
 
Reported: 2018-10-04 09:08 UTC by Adam Mariš
Modified: 2024-10-09 11:19 UTC (History)
62 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-04 09:10:33 UTC
Embargoed:


Attachments (Terms of Use)

Description Adam Mariš 2018-10-04 09:08:09 UTC
An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security realm reference" implies "effectively unsecured." The vendor explicitly supports these unsecured configurations because they have valid use cases during development.

Comment 1 Adam Mariš 2018-10-04 09:08:39 UTC
Acknowledgments:

Name: Jean-marie Bourbon (Excellium-Services), Anthony Maia (Excellium-Services)

Comment 2 Adam Mariš 2018-10-04 09:08:57 UTC
Statement:

Red Hat Product Security does not consider this issue to be a vulnerability. The default installation are by default secured and set to have an authentication mechanism in place. It is possible to explicitly remove the realm from the configuration files when needed. For example, in case there's need to run in single user mode for development use, ability to switch off security is desirable so the admin console can be accessed without the need for user accounts. There is adequate mechanism in place to secure the WildFly environment.


Note You need to log in before you can comment on or make changes to this bug.