CVE-2021-3536: 
Java vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in Wildfly versions before 23.0.2.Final. The flaw exists in the admin console when creating a new role in domain mode, where it is possible to inject malicious payload through the name field. This vulnerability was assigned CVE-2021-3536 and was discovered by Damian Bury (Red Hat Bugzilla).

The vulnerability exists in the admin console's role creation functionality specifically when operating in domain mode. The issue stems from insufficient input validation in the name field when creating new roles, allowing for potential XSS payload injection. The vulnerability affects the org.jboss.hal:hal-ballroom component (Red Hat CVE).

This vulnerability affects both the confidentiality and integrity of the system. If exploited, an attacker could potentially execute malicious scripts in the context of the admin console, potentially leading to unauthorized access to sensitive information or manipulation of admin console functionality (CVE Mitre).

The vulnerability has been fixed in Wildfly version 23.0.2.Final. Users are advised to upgrade to this version or later. Multiple Red Hat products have received security updates to address this vulnerability, including JBoss Enterprise Application Platform 7.3 and 7.4, Red Hat Single Sign-On 7.4.8, and Red Hat Fuse 7.10 (Red Hat Errata).