CVE-2018-10683: redhat wildfly Improper Authentication

Vulnerability summary

CVE-2018-10683 is a critical (CVSS 9.8) Improper Authentication vulnerability in redhat wildfly. EPSS estimates a 1.74% chance of exploitation in the next 30 days, higher than 77.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-05-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security realm reference" implies "effectively unsecured." The vendor explicitly supports these unsecured configurations because they have valid use cases during development

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.