CVE-2025-23368

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-23368	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2337621	Vendor Advisory
https://www.gruppotim.it/it/footer/red-team.html	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:data_grid:8.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:::::::*
	cpe:2.3:a:redhat:wildfly_elytron:-:::::::*

History

No history.

Information

Published : 2025-03-04 16:15

Updated : 2025-10-14 16:56

NVD link : CVE-2025-23368

Mitre link : CVE-2025-23368

CVE.ORG link : CVE-2025-23368

JSON object : View

Products Affected

redhat

data_grid
jboss_enterprise_application_platform
wildfly_elytron

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2025-23368", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-03-04T16:15:39.270", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-23368", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337621", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.gruppotim.it/it/footer/red-team.html", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en la integraci\u00f3n de Wildfly Elytron. El componente no implementa medidas suficientes para evitar m\u00faltiples intentos fallidos de autenticaci\u00f3n en un corto per\u00edodo de tiempo, lo que lo hace m\u00e1s susceptible a ataques de fuerza bruta a trav\u00e9s de la interfaz de l\u00ednea de comandos."}], "lastModified": "2025-10-14T16:56:41.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7095200A-4DAC-4433-99E8-86CA88E1E4D4"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72A54BDA-311C-413B-8E4D-388AD65A170A"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D8BC03A-4198-4488-946B-3F6B43962942"}, {"criteria": "cpe:2.3:a:redhat:wildfly_elytron:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFEA6A65-6254-48E3-8BB0-A4D7805C01AF"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}