CVE-2022-3143

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-203

Affected software

Vendor	Product	Versions
redhat.com	Wildfly-elytron	>= 1.15.15, < 1.15.15

References

https://access.redhat.com/security/cve/CVE-2022-3143Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-3143Vendor Advisory

Timeline

Published: Jan 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-31444.8The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and inc CVE-2022-314469.8Tenda AC18 router V15.03.05.19 and V15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter CVE-2022-314477.5An XML external entity (XXE) injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafte CVE-2022-31454.7An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary CVE-2022-314546.1Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books. NOTE: this is disputed by the ve CVE-2022-314556.1* A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payl CVE-2022-314566.1A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa CVE-2022-314577.5RTX TRAP v1.0 allows attackers to perform a directory traversal via a crafted request sent to the endpoint /data/.CVE-2022-314586.1RTX TRAP v1.0 was discovered to be vulnerable to host header poisoning.CVE-2022-314596.5Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth.CVE-2022-31465.5A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently rest CVE-2022-314607.4Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value.