wildfly-core vulnerabilities

A flaw in wildfly-core allows a remote attacker authenticated as a 'deployer' account to import and deploy a malicious archive from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive.

A flaw in wildfly-core allows a remote user with administrative privileges to inject a malformed payload into the Inet Address field through the Management Model. This causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file.

A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.