CVE-2021-3717

Published: May 24, 2022Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.

Affected (5)

Products: Redhat: Jboss Enterprise Application Platform, Single Sign On, Wildfly Core

3 products

Jboss Enterprise Application Platform

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	All versions
Redhat Single Sign On	All versions
Redhat Wildfly Core	Before 17.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.4

Configuration C

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.3

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0

Related CWEs

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=1991305

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://security.netapp.com/advisory/ntap-20220804-0002/

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1991305

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://security.netapp.com/advisory/ntap-20220804-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.