CVE-2023-4061
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.
Risk Assessment
A malicious user with management privileges can access sensitive information in the Wildfly system. This may lead to confidentiality breaches and further privilege escalation.
Recommendation
Update wildfly-core to a version containing the fix. Restrict management privileges and monitor HAL interface activity for unauthorized operations.
Other vulnerabilities in wildfly-core
See all- CVE-2026-24330Medium
A flaw in wildfly-core allows a remote attacker authenticated as a 'deployer' account to import and deploy a malicious archive from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive.
- CVE-2026-24329Medium
A flaw in wildfly-core allows a remote user with administrative privileges to inject a malformed payload into the Inet Address field through the Management Model. This causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file.
Original NVD description (English source)
A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.