CVE-2021-3503: 
Java vulnerability analysis and mitigation

A flaw was discovered in Wildfly where insufficient Role-Based Access Control (RBAC) restrictions could lead to exposure of metrics data. The vulnerability, identified as CVE-2021-3503, affects Wildfly versions up to 23.0.0.Final and was patched in version 23.0.1.Final (NVD, GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The flaw exists in the RBAC implementation where users could see more metrics data than they should have access to based on their permissions. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD, GitHub Advisory).

The primary impact of this vulnerability is to data confidentiality, as it could allow unauthorized access to metrics data. The vulnerability has been rated with Low impact on confidentiality, with no impact on integrity or availability (NVD).

The vulnerability has been fixed in Wildfly version 23.0.1.Final. Users are advised to upgrade to this version or later to address the security issue. The fix involves properly configuring ModelNode when RBAC is enabled (GitHub PR).