CVE-2022-3143: redhat jboss_enterprise_application_platform Observable Discrepancy
Vulnerability summary
CVE-2022-3143 is a high (CVSS 7.4) Observable Discrepancy vulnerability in redhat jboss_enterprise_application_platform. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5Timeline
- 11-01-2023PublishedVulnerability first disclosed.
- 09-04-2025Last modifiedVulnerability information updated.
Description
wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.58% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat2 products
Org.wildfly.security1 product
- wildfly-elytron< 1.15.15.Final | ≥ 1.16.0.CR1, < 1.20.3.Final
Redhat.com1 product
- wildfly-elytron≥ 1.15.15, < 1.15.15
3 vendors · 4 products
