CVE-2022-3143

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-203

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-31444.8The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and incCVE-2022-314469.8Tenda AC18 router V15.03.05.19 and V15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter CVE-2022-314477.5An XML external entity (XXE) injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafteCVE-2022-31454.7An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitraryCVE-2022-314546.1Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books. NOTE: this is disputed by the veCVE-2022-314556.1* A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted paylCVE-2022-314566.1A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2022-314577.5RTX TRAP v1.0 allows attackers to perform a directory traversal via a crafted request sent to the endpoint /data/.CVE-2022-314586.1RTX TRAP v1.0 was discovered to be vulnerable to host header poisoning.CVE-2022-314596.5Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth.CVE-2022-31465.5A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restCVE-2022-314607.4Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value.