Description

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=1948001

Related Vulnerabilities

CVE-2021-4178 Vulnerability in maven package io.fabric8:kubernetes-client

CVE-2023-2976 Vulnerability in maven package com.google.guava:guava

CVE-2019-14820 Vulnerability in maven package org.keycloak:keycloak-core

CVE-2018-16479 Vulnerability in npm package http-live-simulator

CVE-2018-11693 Vulnerability in npm package node-sass

Severity

Medium

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Issue Tracking Vendor Advisory