CVE-2021-3536: XSS in WildFly Parent ≤9.0.2.Final

Successful exploitation of CVE-2021-3536 allows an attacker to inject arbitrary JavaScript code into the WildFly admin console. This code could then be executed in the context of a user accessing the console, potentially leading to session hijacking, unauthorized access to sensitive data, or defacement of the administrative interface. The impact is primarily focused on the confidentiality and integrity of the WildFly environment, as an attacker could steal credentials or modify configurations. While the CVSS score is LOW, the potential for privilege escalation within the administrative domain makes this a concerning vulnerability.

1. Reserved2021-05-05
2. Published2021-05-25
3. Modified2023-12-06
4. EPSS updated2026-04-02

The primary mitigation for CVE-2021-3536 is to upgrade WildFly to version 23.0.2.Final or later, which includes the fix for this vulnerability. If immediate upgrade is not possible, consider restricting access to the admin console to trusted users only. Implement strict input validation on the role name field to prevent the injection of malicious payloads. While a WAF might offer some protection, it is not a substitute for patching. Regularly review WildFly logs for any suspicious activity related to role creation or modification.