{"id":"CVE-2024-1233","state":"PUBLISHED","title":"Eap: wildfly-elytron has a ssrf security issue","description":"A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.","publishedAt":"2024-04-09T07:01:47.673Z","updatedAt":"2026-10-01T03:01:05.073Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"redhat"},"assigner":"redhat","products":["wildfly","Red Hat Red Hat JBoss Enterprise Application Platform","Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","Red Hat Red Hat JBoss Enterprise Application Platform 8","Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack"],"affected":[{"packageName":"wildfly","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"32.0.0.Final","versionType":"maven"}],"collectionURL":"https://github.com/wildfly/wildfly"},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform","packageName":"org.wildfly.security/wildfly-elytron","defaultStatus":"affected","versions":[{"version":"1.15.23.Final-redhat-00001","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-glassfish-el","defaultStatus":"affected","versions":[{"version":"0:3.0.1-4.b08_redhat_00005.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-hibernate","defaultStatus":"affected","versions":[{"version":"0:5.1.17-3.Final_redhat_00004.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-jackson-databind","defaultStatus":"affected","versions":[{"version":"0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-jboss-ejb-client","defaultStatus":"affected","versions":[{"version":"0:4.0.12-1.Final_redhat_00002.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.63-2.Final_redhat_00003.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:1.4.18-16.SP14_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.1.11-4.GA_redhat_00002.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:1.1.14-1.Final_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly-http-client","defaultStatus":"affected","versions":[{"version":"0:1.0.21-1.Final_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly-naming-client","defaultStatus":"affected","versions":[{"version":"0:1.0.13-1.Final_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly-openssl","defaultStatus":"affected","versions":[{"version":"0:1.0.12-1.Final_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly-openssl-linux","defaultStatus":"affected","versions":[{"version":"0:1.0.12-6.Final_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-annotations","defaultStatus":"affected","versions":[{"version":"0:2.10.4-3.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-core","defaultStatus":"affected","versions":[{"version":"0:2.10.4-3.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-databind","defaultStatus":"affected","versions":[{"version":"0:2.10.4-5.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-jaxrs-providers","defaultStatus":"affected","versions":[{"version":"0:2.10.4-3.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-modules-base","defaultStatus":"affected","versions":[{"version":"0:2.10.4-5.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-modules-java8","defaultStatus":"affected","versions":[{"version":"0:2.10.4-2.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jboss-server-migration","defaultStatus":"affected","versions":[{"version":"0:1.7.2-16.Final_redhat_00017.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.63-5.Final_redhat_00003.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.0.41-4.SP5_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.3.14-3.GA_redhat_00002.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:1.10.17-1.Final_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-apache-cxf","defaultStatus":"affected","versions":[{"version":"0:3.5.8-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-hal-console","defaultStatus":"affected","versions":[{"version":"0:3.3.22-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-infinispan","defaultStatus":"affected","versions":[{"version":"0:11.0.19-2.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-jboss-ejb-client","defaultStatus":"affected","versions":[{"version":"0:4.0.54-3.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-jboss-jsf-api_2.3_spec","defaultStatus":"affected","versions":[{"version":"0:3.0.0-8.SP08_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-jboss-metadata","defaultStatus":"affected","versions":[{"version":"0:13.5.0-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-jboss-modules","defaultStatus":"affected","versions":[{"version":"0:1.12.3-3.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-jboss-server-migration","defaultStatus":"affected","versions":[{"version":"0:1.10.0-36.Final_redhat_00035.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.32-1.SP1_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.17-2.GA_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly-discovery","defaultStatus":"affected","versions":[{"version":"0:1.2.4-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:1.15.23-2.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly-http-client","defaultStatus":"affected","versions":[{"version":"0:1.1.17-1.Final_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly-transaction-client","defaultStatus":"affected","versions":[{"version":"0:1.1.19-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wss4j","defaultStatus":"affected","versions":[{"version":"0:2.4.3-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-xml-security","defaultStatus":"affected","versions":[{"version":"0:2.3.4-1.redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-apache-cxf","defaultStatus":"affected","versions":[{"version":"0:3.5.8-1.redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-hal-console","defaultStatus":"affected","versions":[{"version":"0:3.3.22-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-infinispan","defaultStatus":"affected","versions":[{"version":"0:11.0.19-2.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-jboss-ejb-client","defaultStatus":"affected","versions":[{"version":"0:4.0.54-3.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-jboss-jsf-api_2.3_spec","defaultStatus":"affected","versions":[{"version":"0:3.0.0-8.SP08_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-jboss-metadata","defaultStatus":"affected","versions":[{"version":"0:13.5.0-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-jboss-modules","defaultStatus":"affected","versions":[{"version":"0:1.12.3-3.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-jboss-server-migration","defaultStatus":"affected","versions":[{"version":"0:1.10.0-36.Final_redhat_00035.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.32-1.SP1_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.17-2.GA_redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly-discovery","defaultStatus":"affected","versions":[{"version":"0:1.2.4-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:1.15.23-2.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly-http-client","defaultStatus":"affected","versions":[{"version":"0:1.1.17-1.Final_redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly-transaction-client","defaultStatus":"affected","versions":[{"version":"0:1.1.19-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wss4j","defaultStatus":"affected","versions":[{"version":"0:2.4.3-1.redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-xml-security","defaultStatus":"affected","versions":[{"version":"0:2.3.4-1.redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","packageName":"eap7-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:1.15.23-2.Final_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"eap","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-elytron-web","defaultStatus":"affected","versions":[{"version":"0:4.0.1-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:2.2.4-2.SP01_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-elytron-web","defaultStatus":"affected","versions":[{"version":"0:4.0.1-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:2.2.4-2.SP01_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"wildfly","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"]}],"references":["https://access.redhat.com/errata/RHSA-2024:3559","https://access.redhat.com/errata/RHSA-2024:3560","https://access.redhat.com/errata/RHSA-2024:3561","https://access.redhat.com/errata/RHSA-2024:3563","https://access.redhat.com/errata/RHSA-2024:3580","https://access.redhat.com/errata/RHSA-2024:3581","https://access.redhat.com/errata/RHSA-2024:3583","https://access.redhat.com/errata/RHSA-2025:9582","https://access.redhat.com/errata/RHSA-2025:9583","https://access.redhat.com/security/cve/CVE-2024-1233","https://bugzilla.redhat.com/show_bug.cgi?id=2262849","https://github.com/advisories/GHSA-v4mm-q8fv-r2w5","https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523","https://issues.redhat.com/browse/WFLY-19226"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1233.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-1233","state":"PUBLISHED","datePublished":"2024-04-09T07:01:47.673Z","dateUpdated":"2026-10-01T03:01:05.073Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2024-02-05T18:40:46.701Z"},"containers":{"cna":{"title":"Eap: wildfly-elytron has a ssrf security issue","descriptions":[{"lang":"en","value":"A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability."}],"affected":[{"packageName":"wildfly","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"32.0.0.Final","versionType":"maven"}],"collectionURL":"https://github.com/wildfly/wildfly"},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform","packageName":"org.wildfly.security/wildfly-elytron","defaultStatus":"affected","versions":[{"version":"1.15.23.Final-redhat-00001","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-glassfish-el","defaultStatus":"affected","versions":[{"version":"0:3.0.1-4.b08_redhat_00005.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-hibernate","defaultStatus":"affected","versions":[{"version":"0:5.1.17-3.Final_redhat_00004.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-jackson-databind","defaultStatus":"affected","versions":[{"version":"0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-jboss-ejb-client","defaultStatus":"affected","versions":[{"version":"0:4.0.12-1.Final_redhat_00002.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.63-2.Final_redhat_00003.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:1.4.18-16.SP14_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.1.11-4.GA_redhat_00002.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:1.1.14-1.Final_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly-http-client","defaultStatus":"affected","versions":[{"version":"0:1.0.21-1.Final_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly-naming-client","defaultStatus":"affected","versions":[{"version":"0:1.0.13-1.Final_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly-openssl","defaultStatus":"affected","versions":[{"version":"0:1.0.12-1.Final_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","packageName":"eap7-wildfly-openssl-linux","defaultStatus":"affected","versions":[{"version":"0:1.0.12-6.Final_redhat_00001.1.ep7.el7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-annotations","defaultStatus":"affected","versions":[{"version":"0:2.10.4-3.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-core","defaultStatus":"affected","versions":[{"version":"0:2.10.4-3.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-databind","defaultStatus":"affected","versions":[{"version":"0:2.10.4-5.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-jaxrs-providers","defaultStatus":"affected","versions":[{"version":"0:2.10.4-3.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-modules-base","defaultStatus":"affected","versions":[{"version":"0:2.10.4-5.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jackson-modules-java8","defaultStatus":"affected","versions":[{"version":"0:2.10.4-2.redhat_00006.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-jboss-server-migration","defaultStatus":"affected","versions":[{"version":"0:1.7.2-16.Final_redhat_00017.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.63-5.Final_redhat_00003.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.0.41-4.SP5_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.3.14-3.GA_redhat_00002.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","packageName":"eap7-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:1.10.17-1.Final_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-apache-cxf","defaultStatus":"affected","versions":[{"version":"0:3.5.8-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-hal-console","defaultStatus":"affected","versions":[{"version":"0:3.3.22-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-infinispan","defaultStatus":"affected","versions":[{"version":"0:11.0.19-2.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-jboss-ejb-client","defaultStatus":"affected","versions":[{"version":"0:4.0.54-3.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-jboss-jsf-api_2.3_spec","defaultStatus":"affected","versions":[{"version":"0:3.0.0-8.SP08_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-jboss-metadata","defaultStatus":"affected","versions":[{"version":"0:13.5.0-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-jboss-modules","defaultStatus":"affected","versions":[{"version":"0:1.12.3-3.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-jboss-server-migration","defaultStatus":"affected","versions":[{"version":"0:1.10.0-36.Final_redhat_00035.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.32-1.SP1_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.17-2.GA_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly-discovery","defaultStatus":"affected","versions":[{"version":"0:1.2.4-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:1.15.23-2.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly-http-client","defaultStatus":"affected","versions":[{"version":"0:1.1.17-1.Final_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wildfly-transaction-client","defaultStatus":"affected","versions":[{"version":"0:1.1.19-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-wss4j","defaultStatus":"affected","versions":[{"version":"0:2.4.3-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-xml-security","defaultStatus":"affected","versions":[{"version":"0:2.3.4-1.redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-apache-cxf","defaultStatus":"affected","versions":[{"version":"0:3.5.8-1.redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-hal-console","defaultStatus":"affected","versions":[{"version":"0:3.3.22-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-infinispan","defaultStatus":"affected","versions":[{"version":"0:11.0.19-2.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-jboss-ejb-client","defaultStatus":"affected","versions":[{"version":"0:4.0.54-3.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-jboss-jsf-api_2.3_spec","defaultStatus":"affected","versions":[{"version":"0:3.0.0-8.SP08_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-jboss-metadata","defaultStatus":"affected","versions":[{"version":"0:13.5.0-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-jboss-modules","defaultStatus":"affected","versions":[{"version":"0:1.12.3-3.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-jboss-server-migration","defaultStatus":"affected","versions":[{"version":"0:1.10.0-36.Final_redhat_00035.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.32-1.SP1_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.17-2.GA_redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly-discovery","defaultStatus":"affected","versions":[{"version":"0:1.2.4-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:1.15.23-2.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly-http-client","defaultStatus":"affected","versions":[{"version":"0:1.1.17-1.Final_redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wildfly-transaction-client","defaultStatus":"affected","versions":[{"version":"0:1.1.19-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-wss4j","defaultStatus":"affected","versions":[{"version":"0:2.4.3-1.redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-xml-security","defaultStatus":"affected","versions":[{"version":"0:2.3.4-1.redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","packageName":"eap7-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:1.15.23-2.Final_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"eap","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-elytron-web","defaultStatus":"affected","versions":[{"version":"0:4.0.1-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:2.2.4-2.SP01_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-elytron-web","defaultStatus":"affected","versions":[{"version":"0:4.0.1-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:2.2.4-2.SP01_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"wildfly","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:3559","name":"RHSA-2024:3559","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3560","name":"RHSA-2024:3560","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3561","name":"RHSA-2024:3561","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3563","name":"RHSA-2024:3563","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3580","name":"RHSA-2024:3580","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3581","name":"RHSA-2024:3581","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3583","name":"RHSA-2024:3583","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9582","name":"RHSA-2025:9582","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9583","name":"RHSA-2025:9583","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1233","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262849","name":"RHBZ#2262849","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/advisories/GHSA-v4mm-q8fv-r2w5"},{"url":"https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523"},{"url":"https://issues.redhat.com/browse/WFLY-19226"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-01T03:01:05.073Z"},"datePublic":"2024-04-02T00:00:00.000Z","x_redhatCweChain":"CWE-918: Server-Side Request Forgery (SSRF)","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"timeline":[{"lang":"en","time":"2024-02-05T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-04-02T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Jingcheng Yang and Jianjun Chen from Sichuan University and Zhongguancun Lab for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:3559","name":"RHSA-2024:3559","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3560","name":"RHSA-2024:3560","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3561","name":"RHSA-2024:3561","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3563","name":"RHSA-2024:3563","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3580","name":"RHSA-2024:3580","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3581","name":"RHSA-2024:3581","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3583","name":"RHSA-2024:3583","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1233","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262849","name":"RHBZ#2262849","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://github.com/advisories/GHSA-v4mm-q8fv-r2w5","tags":["x_transferred"]},{"url":"https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523","tags":["x_transferred"]},{"url":"https://issues.redhat.com/browse/WFLY-19226","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:33:25.381Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-04-09T19:46:50.360202Z","id":"CVE-2024-1233","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-22T20:09:07.144Z"}}]}}}