Wildfly Authorization Misconfiguration
Date: 2022-05
Affected: maven/org.wildfly.core:wildfly-host-controller
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2019-14838
CWE: CWE-284
CVSS: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)

A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server


Mitigations:

Architectural layers (MAESTRO):