CVE-2024-1233
Estado: AplazadaAlta (7.3)—
A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Puntuación base: 7.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.78%
- Percentil entre todas las CVEs puntuadas: 54
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-918
Referencias
- https://access.redhat.com/errata/RHSA-2024:3559
- https://access.redhat.com/errata/RHSA-2024:3560
- https://access.redhat.com/errata/RHSA-2024:3561
- https://access.redhat.com/errata/RHSA-2024:3563
- https://access.redhat.com/errata/RHSA-2024:3580
- https://access.redhat.com/errata/RHSA-2024:3581
- https://access.redhat.com/errata/RHSA-2024:3583
- https://access.redhat.com/errata/RHSA-2025:9582
- https://access.redhat.com/errata/RHSA-2025:9583
- https://access.redhat.com/security/cve/CVE-2024-1233
- https://bugzilla.redhat.com/show_bug.cgi?id=2262849
- https://github.com/advisories/GHSA-v4mm-q8fv-r2w5
- https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523
- https://issues.redhat.com/browse/WFLY-19226
- https://access.redhat.com/errata/RHSA-2024:3559
- https://access.redhat.com/errata/RHSA-2024:3560
- https://access.redhat.com/errata/RHSA-2024:3561
- https://access.redhat.com/errata/RHSA-2024:3563
- https://access.redhat.com/errata/RHSA-2024:3580
- https://access.redhat.com/errata/RHSA-2024:3581
- https://access.redhat.com/errata/RHSA-2024:3583
- https://access.redhat.com/security/cve/CVE-2024-1233
- https://bugzilla.redhat.com/show_bug.cgi?id=2262849
- https://github.com/advisories/GHSA-v4mm-q8fv-r2w5
- https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523
- https://issues.redhat.com/browse/WFLY-19226
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-1233",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-1233",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-04-09T19:46:50.360202Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.3,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 3.4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "32.0.0.Final",
"versionType": "maven"
}
],
"packageName": "wildfly",
"collectionURL": "https://github.com/wildfly/wildfly",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform",
"versions": [
{
"status": "unaffected",
"version": "1.15.23.Final-redhat-00001",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "org.wildfly.security/wildfly-elytron",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:3.0.1-4.b08_redhat_00005.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-glassfish-el",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:5.1.17-3.Final_redhat_00004.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-hibernate",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-databind",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:4.0.12-1.Final_redhat_00002.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-ejb-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:4.1.63-2.Final_redhat_00003.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.4.18-16.SP14_redhat_00001.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-undertow",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:7.1.11-4.GA_redhat_00002.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.1.14-1.Final_redhat_00001.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-elytron",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.0.21-1.Final_redhat_00001.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-http-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.0.13-1.Final_redhat_00001.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-naming-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.0.12-1.Final_redhat_00001.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-openssl",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.0.12-6.Final_redhat_00001.1.ep7.el7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-openssl-linux",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.10.4-3.redhat_00006.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-annotations",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.10.4-3.redhat_00006.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-core",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.10.4-5.redhat_00006.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-databind",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.10.4-3.redhat_00006.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-jaxrs-providers",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.10.4-5.redhat_00006.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-modules-base",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.10.4-2.redhat_00006.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-modules-java8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.7.2-16.Final_redhat_00017.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-server-migration",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:4.1.63-5.Final_redhat_00003.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.0.41-4.SP5_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-undertow",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:7.3.14-3.GA_redhat_00002.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.10.17-1.Final_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-elytron",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.5.8-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-apache-cxf",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.3.22-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-hal-console",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:11.0.19-2.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-infinispan",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:4.0.54-3.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-ejb-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.0.0-8.SP08_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-jsf-api_2.3_spec",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:13.5.0-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-metadata",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.12.3-3.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-modules",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.10.0-36.Final_redhat_00035.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-server-migration",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.32-1.SP1_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-undertow",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:7.4.17-2.GA_redhat_00002.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.2.4-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-discovery",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.15.23-2.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-elytron",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.1.17-1.Final_redhat_00002.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-http-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.1.19-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-transaction-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.4.3-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wss4j",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.3.4-1.redhat_00002.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-xml-security",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.5.8-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-apache-cxf",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.3.22-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-hal-console",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:11.0.19-2.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-infinispan",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:4.0.54-3.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-ejb-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.0.0-8.SP08_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-jsf-api_2.3_spec",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:13.5.0-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-metadata",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.12.3-3.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-modules",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.10.0-36.Final_redhat_00035.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-server-migration",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.32-1.SP1_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-undertow",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:7.4.17-2.GA_redhat_00002.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.2.4-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-discovery",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.15.23-2.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-elytron",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.1.17-1.Final_redhat_00002.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-http-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.1.19-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-transaction-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.4.3-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wss4j",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.3.4-1.redhat_00002.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-xml-security",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.15.23-2.Final_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly-elytron",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"packageName": "eap",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:4.0.1-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-elytron-web",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.4-2.SP01_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-wildfly-elytron",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:4.0.1-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-elytron-web",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.4-2.SP01_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-wildfly-elytron",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"packageName": "wildfly",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"defaultStatus": "affected"
}
]
}
],
"published": "2024-04-09T07:15:08.060",
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2024:3559",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3560",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3561",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3563",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3580",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3581",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3583",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:9582",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:9583",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-1233",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262849",
"source": "secalert@redhat.com"
},
{
"url": "https://github.com/advisories/GHSA-v4mm-q8fv-r2w5",
"source": "secalert@redhat.com"
},
{
"url": "https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523",
"source": "secalert@redhat.com"
},
{
"url": "https://issues.redhat.com/browse/WFLY-19226",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3559",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3560",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3561",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3563",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3580",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3581",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:3583",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-1233",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262849",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/advisories/GHSA-v4mm-q8fv-r2w5",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://issues.redhat.com/browse/WFLY-19226",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability."
},
{
"lang": "es",
"value": "Se encontró una falla en `JwtValidator.resolvePublicKey` en JBoss EAP, donde el validador verifica jku y envía una solicitud HTTP. Durante este proceso, no se realiza ninguna lista blanca ni ningún otro comportamiento de filtrado en la dirección URL de destino, lo que puede provocar una vulnerabilidad Server-Side Request Forgery (SSRF)."
}
],
"lastModified": "2026-06-17T07:03:46.407",
"sourceIdentifier": "secalert@redhat.com"
}