Red Hat Build of Keycloak Wildfly Server Role Based Access Control Provider access control

Summaryinfo

A vulnerability identified as critical has been detected in Red Hat Build of Keycloak, Data Grid, Fuse, JBoss Data Grid, JBoss Enterprise Application Platform, JBoss Enterprise Application Platform Expansion Pack, Process Automation and Single Sign-On. This vulnerability affects unknown code of the component Wildfly Server Role Based Access Control Provider. This manipulation causes access control. This vulnerability is handled as CVE-2025-23367. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Red Hat Build of Keycloak, Data Grid, Fuse, JBoss Data Grid, JBoss Enterprise Application Platform, JBoss Enterprise Application Platform Expansion Pack, Process Automation and Single Sign-On. Affected by this vulnerability is some unknown functionality of the component Wildfly Server Role Based Access Control Provider. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect availability. The summary by CVE is:

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

The advisory is shared at access.redhat.com. This vulnerability is known as CVE-2025-23367 since 01/14/2025. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 12/06/2025). MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 233918 (RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4.21 (RHSA-2025:3465)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (233918), EUVD (EUVD-2025-0214) and CERT Bund (WID-SEC-2025-0230). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Red Hat Enterprise Linux
• NetApp ActiveIQ Unified Manager
• Red Hat WildFly
• Red Hat JBoss Enterprise Application Platform

Productinfo

Type

• Automation Software

Vendor

• Red Hat

Name

• Build of Keycloak
• Data Grid
• Fuse
• JBoss Data Grid
• JBoss Enterprise Application Platform
• JBoss Enterprise Application Platform Expansion Pack
• Process Automation
• Single Sign-On

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion