{"id":"CVE-2023-4503","state":"PUBLISHED","title":"Eap-galleon: custom provisioning creates unsecured http-invoker","description":"An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.","publishedAt":"2024-02-06T08:39:01.685Z","updatedAt":"2024-08-02T07:31:06.073Z","severity":{"score":6.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat EAP 7.4.14","Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack"],"affected":[{"vendor":"Red Hat","product":"EAP 7.4.14","packageName":"eap-galleon","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.28-1.SP1_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.14-5.GA_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.28-1.SP1_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.14-5.GA_redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.28-1.SP1_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.14-5.GA_redhat_00002.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"eap-galleon","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"]}],"references":["https://access.redhat.com/errata/RHSA-2023:7637","https://access.redhat.com/errata/RHSA-2023:7638","https://access.redhat.com/errata/RHSA-2023:7639","https://access.redhat.com/errata/RHSA-2023:7641","https://access.redhat.com/security/cve/CVE-2023-4503","https://bugzilla.redhat.com/show_bug.cgi?id=2184751"],"weaknesses":["CWE-665"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/4xxx/CVE-2023-4503.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-4503","state":"PUBLISHED","datePublished":"2024-02-06T08:39:01.685Z","dateUpdated":"2024-08-02T07:31:06.073Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-08-23T20:29:02.164Z"},"containers":{"cna":{"title":"Eap-galleon: custom provisioning creates unsecured http-invoker","descriptions":[{"lang":"en","value":"An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server."}],"affected":[{"vendor":"Red Hat","product":"EAP 7.4.14","packageName":"eap-galleon","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.28-1.SP1_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.14-5.GA_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.28-1.SP1_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.14-5.GA_redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.28-1.SP1_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.14-5.GA_redhat_00002.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"eap-galleon","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:7637","name":"RHSA-2023:7637","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7638","name":"RHSA-2023:7638","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7639","name":"RHSA-2023:7639","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7641","name":"RHSA-2023:7641","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4503","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184751","name":"RHBZ#2184751","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-665","description":"Improper Initialization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2024-05-03T15:32:37.712Z"},"datePublic":"2023-12-04T00:00:00.000Z","x_redhatCweChain":"CWE-665: Improper Initialization","timeline":[{"lang":"en","time":"2022-11-22T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-12-04T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-4503","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-02-07T15:53:22.923436Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-05T17:21:39.138Z"}},{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:7637","name":"RHSA-2023:7637","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7638","name":"RHSA-2023:7638","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7639","name":"RHSA-2023:7639","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7641","name":"RHSA-2023:7641","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4503","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184751","name":"RHBZ#2184751","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:31:06.073Z"}}]}}}