Security readout for executives and security teams
Plain-English summary
An authenticated low-privilege WildFly management user may suspend or resume the server despite having a read-only Monitor or Auditor role. This can interrupt hosted applications and business services. The issue affects availability, not data confidentiality or integrity, according to the supplied CVSS assessment.
Executive priority
Schedule remediation promptly, prioritizing availability-critical application servers. Accelerate action where management interfaces are broadly reachable, credentials are shared, or Monitor and Auditor access is extensive. This is not presented as an unauthenticated takeover or data-theft issue.
Technical view
WildFly’s suspend and resume management handlers omit required authorization checks under the RBAC provider. A network-accessible user with limited management credentials can invoke availability-impacting operations without the intended permission. The supplied CVSS v3.1 score is 6.5: network reachable, low complexity, low privileges, no user interaction, and high availability impact.
Likely exposure
Exposure requires WildFly or JBoss EAP management access, RBAC authorization, and an authenticated low-privilege account. The bundle identifies affected package builds across EAP 7.4 and EAP 8.0 environments, but also contains product-level unaffected records. Confirm exposure against the applicable Red Hat advisory rather than relying only on product names.
Exploitation context
The flaw is remotely reachable through management operations but requires valid low-privilege credentials. Monitor or Auditor users are specifically relevant. The supplied record is not in KEV, and the sources provided do not establish active exploitation or a public working exploit.
Researcher notes
The affected-data mapping is internally complex: generic EAP 7 and EAP 8 entries are marked unaffected while specific builds and several seemingly unrelated package names are marked affected. The bundle also does not clarify the wildfly-core version-bound semantics. Use vendor advisories for authoritative package applicability and fixed-build determination.
Mitigation direction
- Apply updates identified by the applicable Red Hat security advisory after compatibility testing.
- Confirm exact affected builds and corrected packages using Red Hat guidance.
- Restrict management interfaces to trusted administrative networks and authenticated operators.
- Review Monitor and Auditor account necessity; remove unnecessary access pending remediation.
Validation and detection
- Inventory WildFly and JBoss EAP versions, operating systems, and installed package builds.
- Verify whether the RBAC provider protects management operations.
- Identify accounts assigned Monitor, Auditor, or equivalent limited management roles.
- Review management audit logs for unexpected suspend or resume activity.
- Confirm installed updates against the applicable Red Hat errata.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-23367 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6redhatVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2025:3465CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:3467CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:3989CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:3990CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:3992CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-23367CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2337620CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://github.com/advisories/GHSA-qr6x-62gq-4ccpCVE reference, redhat
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.