Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-23368GHSA-QHP6-6P8P-2RQH

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 32.0.0.Beta3, 31.0.3.Final
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • wildfly-core

    through *

  • eap7-wildfly

    Version range not reported

  • org.wildfly.core/wildfly-elytron-integration

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • wildfly-elytron

    Version range not reported

  • wildfly-elytron

    Version range not reported

  • wildfly-elytron

    Version range not reported

  • wildfly-elytron-integration

    Version range not reported

  • wildfly-elytron

    Version range not reported

  • wildfly-elytron

    Version range not reported

  • wildfly-elytron-integration

    Version range not reported

  • wildfly-elytron-integration

    Version range not reported

  • wildfly-elytron

    Version range not reported

  • wildfly-elytron-integration

    Version range not reported

  • wildfly-elytron

    Version range not reported

  • wildfly-elytron-integration

    Version range not reported

  • org.wildfly.core:wildfly-elytron-integrationMaven

    From 32.0.0.Beta1 · fixed in 32.0.0.Beta3

  • org.wildfly.core:wildfly-elytron-integrationMaven

    fixed in 31.0.3.Final

References 7

access.redhat.com

bugzilla.redhat.com

gruppotim.it