Description
It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security identity when executing.
Remediation
References
Related Vulnerabilities
WordPress Plugin Buddypress Component Stats Local File Inclusion (1.0)
PHP-Fusion Other Vulnerability (CVE-2007-3559)
Jenkins Passwords transmitted in plain text (CVE-2020-2251)
WordPress Plugin Testimonial Slider Multiple Cross-Site Scripting Vulnerabilities (1.2.5)
WordPress Plugin Absolute Privacy 'abpr_authenticateUser()' Security Bypass (2.0.5)