CVE-2021-3503

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	wildfly	Fixed in 23.0.1.Final

References

https://access.redhat.com/security/cve/CVE-2021-3503Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1942693Issue Tracking, Vendor Advisory
https://github.com/advisories/GHSA-c4r5-xvgw-2942Third Party Advisory
https://github.com/wildfly/wildfly/pull/14136Patch, Third Party Advisory
https://issues.redhat.com/browse/WFLY-11933Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3503Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1942693Issue Tracking, Vendor Advisory
https://github.com/advisories/GHSA-c4r5-xvgw-2942Third Party Advisory
https://github.com/wildfly/wildfly/pull/14136Patch, Third Party Advisory
https://issues.redhat.com/browse/WFLY-11933Vendor Advisory

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-350304.3A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and c CVE-2021-350318.0A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow CVE-2021-350327.8A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbit CVE-2021-350337.8A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password managem CVE-2021-350349.1An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access th CVE-2021-350356.5A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obt CVE-2021-350366.5A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated at CVE-2021-350376.1Jamf Pro before 10.30.1 allows for an unvalidated URL redirect vulnerability affecting Jamf Pro customers who host their environments on-pre CVE-2021-350397.8kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verif CVE-2021-35045.4A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. CVE-2021-350417.5The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send CVE-2021-350429.8Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a w