CVE-2021-3644

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	wildfly-core	Fixed in 16.0.1.Final, 17.0.0.Final and later.

References

https://access.redhat.com/security/cve/CVE-2021-3644Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1976052Issue Tracking, Vendor Advisory
https://github.com/wildfly/wildfly-core/commit/06dd9884f6ba50470b1fb5a35198a8784f037714Patch, Third Party Advisory
https://github.com/wildfly/wildfly-core/commit/6d8db43cd43b5994b7a14003db978064e086090bPatch, Third Party Advisory
https://github.com/wildfly/wildfly-core/pull/4668Patch, Third Party Advisory
https://issues.redhat.com/browse/WFCORE-5511Patch, Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3644Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1976052Issue Tracking, Vendor Advisory
https://github.com/wildfly/wildfly-core/commit/06dd9884f6ba50470b1fb5a35198a8784f037714Patch, Third Party Advisory
https://github.com/wildfly/wildfly-core/commit/6d8db43cd43b5994b7a14003db978064e086090bPatch, Third Party Advisory
https://github.com/wildfly/wildfly-core/pull/4668Patch, Third Party Advisory
https://issues.redhat.com/browse/WFCORE-5511Patch, Vendor Advisory

Timeline

Published: Aug 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-364409.8Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component A CVE-2021-364438.8Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.CVE-2021-364448.8Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token g CVE-2021-36459.8merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-364506.1Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.CVE-2021-364545.4Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) block CVE-2021-364558.8SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php.CVE-2021-36466.1btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-364607.8VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all commun CVE-2021-364618.8An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section CVE-2021-36476.1URI.js is vulnerable to URL Redirection to Untrusted Site CVE-2021-364719.8Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /