CVE-2024-10234
Vulnerability Summary
Timeline
Description
A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.
CVSS Metrics
- v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
- v3.1•HIGH•Score: 7.3CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
EPSS Trends
Current EPSS score: 0.64%• Percentile: 49%
Techniques & Countermeasures
- CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected Systems
- redhat•build_of_keycloak
na
- redhat•jboss_enterprise_application_platform
8.0
- redhat•eap8-artemis-wildfly-integration
< 0:2.0.3-1.Final_redhat_00001.1.el8eap | < 0:2.0.3-1.Final_redhat_00001.1.el9eap
- redhat•eap8-azure-storage
< 0:8.6.6-5.redhat_00001.1.el8eap | < 0:8.6.6-5.redhat_00001.1.el9eap
- redhat•eap8-eap-product-conf-parent
< 0:800.6.0-2.GA_redhat_00002.1.el8eap | < 0:800.6.0-2.GA_redhat_00002.1.el9eap
- redhat•eap8-eap-product-conf-wildfly-ee-feature-pack
< 0:800.6.0-2.GA_redhat_00002.1.el8eap | < 0:800.6.0-2.GA_redhat_00002.1.el9eap
- redhat•eap8-gnu-getopt
< 0:1.0.13-2.redhat_5.1.el8eap | < 0:1.0.13-2.redhat_5.1.el9eap
- redhat•eap8-h2database
< 0:2.1.214-2.redhat_00001.1.el8eap | < 0:2.1.214-2.redhat_00001.1.el9eap
- redhat•eap8-hal-console
< 0:3.6.23-1.Final_redhat_00001.1.el8eap | < 0:3.6.23-1.Final_redhat_00001.1.el9eap
- redhat•eap8-hibernate-commons-annotations
< 0:6.0.6-2.Final_redhat_00001.1.el8eap | < 0:6.0.6-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jackson-coreutils
< 0:1.8.0-2.redhat_00002.1.el8eap | < 0:1.8.0-2.redhat_00002.1.el9eap
- redhat•eap8-jakarta-authentication-api
< 0:3.0.0-3.redhat_00001.1.el8eap | < 0:3.0.0-3.redhat_00001.1.el9eap
- redhat•eap8-jakarta-authorization-api
< 0:2.1.0-3.redhat_00001.1.el8eap | < 0:2.1.0-3.redhat_00001.1.el9eap
- redhat•eap8-jakarta-enterprise-cdi-api
< 0:4.0.1-2.redhat_00001.1.el8eap | < 0:4.0.1-2.redhat_00001.1.el9eap
- redhat•eap8-jakarta-enterprise-concurrent
< 0:3.0.0-4.redhat_00001.1.el8eap | < 0:3.0.0-4.redhat_00001.1.el9eap
- redhat•eap8-jakarta-enterprise-concurrent-api
< 0:3.0.2-2.redhat_00001.1.el8eap | < 0:3.0.2-2.redhat_00001.1.el9eap
- redhat•eap8-jakarta-enterprise-lang-model
< 0:4.0.1-2.redhat_00001.1.el8eap | < 0:4.0.1-2.redhat_00001.1.el9eap
- redhat•eap8-jakarta-security-enterprise-api
< 0:3.0.0-2.redhat_00001.1.el8eap | < 0:3.0.0-2.redhat_00001.1.el9eap
- redhat•eap8-jakarta-servlet-jsp-api
< 0:3.1.0-3.redhat_00001.1.el8eap | < 0:3.1.0-3.redhat_00001.1.el9eap
- redhat•eap8-javaewah
< 0:1.1.13-2.redhat_00001.1.el8eap | < 0:1.1.13-2.redhat_00001.1.el9eap
- redhat•eap8-jboss-aesh
< 0:2.4.0-2.redhat_00001.1.el8eap | < 0:2.4.0-2.redhat_00001.1.el9eap
- redhat•eap8-jboss-common-beans
< 0:2.0.1-2.Final_redhat_00001.1.el8eap | < 0:2.0.1-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-dmr
< 0:1.6.1-2.Final_redhat_00001.1.el8eap | < 0:1.6.1-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-ejb3-ext-api
< 0:2.3.0-2.Final_redhat_00001.1.el8eap | < 0:2.3.0-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-el-api_5.0_spec
< 0:4.0.1-2.Final_redhat_00001.1.el8eap | < 0:4.0.1-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-genericjms
< 0:3.0.0-3.Final_redhat_00001.1.el8eap | < 0:3.0.0-3.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-iiop-client
< 0:2.0.1-2.Final_redhat_00001.1.el8eap | < 0:2.0.1-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-invocation
< 0:2.0.0-2.Final_redhat_00001.1.el8eap | < 0:2.0.0-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-logmanager
< 0:2.1.19-2.Final_redhat_00001.1.el8eap | < 0:2.1.19-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-msc
< 0:1.5.1-2.Final_redhat_00001.1.el8eap | < 0:1.5.1-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-remoting-jmx
< 0:3.0.4-2.Final_redhat_00001.1.el8eap | < 0:3.0.4-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-stdio
< 0:1.1.0-2.Final_redhat_00001.1.el8eap | < 0:1.1.0-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-threads
< 0:2.4.0-3.Final_redhat_00001.1.el8eap | < 0:2.4.0-3.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-transaction-spi
< 0:8.0.0-3.Final_redhat_00001.1.el8eap | < 0:8.0.0-3.Final_redhat_00001.1.el9eap
- redhat•eap8-jboss-vfs
< 0:3.3.0-2.Final_redhat_00001.1.el8eap | < 0:3.3.0-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jbossws-api
< 0:3.0.0-2.Final_redhat_00001.1.el8eap | < 0:3.0.0-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jbossws-common
< 0:5.1.0-1.Final_redhat_00001.1.el8eap | < 0:5.1.0-1.Final_redhat_00001.1.el9eap
- redhat•eap8-jbossws-cxf
< 0:7.3.1-1.Final_redhat_00001.1.el8eap | < 0:7.3.1-1.Final_redhat_00001.1.el9eap
- redhat•eap8-jbossws-spi
< 0:5.0.0-2.Final_redhat_00001.1.el8eap | < 0:5.0.0-2.Final_redhat_00001.1.el9eap
- redhat•eap8-jcip-annotations
< 0:1.0.0-2.redhat_8.1.el8eap | < 0:1.0.0-2.redhat_8.1.el9eap
- redhat•eap8-json-patch
< 0:1.9.0-2.redhat_00002.1.el8eap | < 0:1.9.0-2.redhat_00002.1.el9eap
- redhat•eap8-jul-to-slf4j-stub
< 0:1.0.1-2.Final_redhat_3.1.el8eap | < 0:1.0.1-2.Final_redhat_3.1.el9eap
- redhat•eap8-reactivex-rxjava2
< 0:2.2.21-2.redhat_00001.2.el8eap | < 0:2.2.21-2.redhat_00001.2.el9eap
- redhat•eap8-slf4j-jboss-logmanager
< 0:2.0.1-2.Final_redhat_00001.1.el8eap | < 0:2.0.1-2.Final_redhat_00001.1.el9eap
- redhat•eap8-staxmapper
< 0:1.4.0-2.Final_redhat_00001.1.el8eap | < 0:1.4.0-2.Final_redhat_00001.1.el9eap
- redhat•eap8-wildfly
< 0:8.0.6-5.GA_redhat_00004.1.el8eap | < 0:8.0.6-5.GA_redhat_00004.1.el9eap
- redhat•eap8-wildfly-common
< 0:1.6.0-4.Final_redhat_00001.1.el8eap | < 0:1.6.0-4.Final_redhat_00001.1.el9eap
- redhat•eap8-wildfly-java-jdk11
< 0:8.0.6-5.GA_redhat_00004.1.el8eap | < 0:8.0.6-5.GA_redhat_00004.1.el9eap
- redhat•eap8-wildfly-java-jdk17
< 0:8.0.6-5.GA_redhat_00004.1.el8eap | < 0:8.0.6-5.GA_redhat_00004.1.el9eap
- redhat•eap8-wildfly-java-jdk21
< 0:8.0.6-5.GA_redhat_00004.1.el8eap | < 0:8.0.6-5.GA_redhat_00004.1.el9eap
Showing first 50 affected entries in server-rendered view.
References (33)
- https://access.redhat.com/errata/RHSA-2025:10924
- https://access.redhat.com/errata/RHSA-2025:10925
- https://access.redhat.com/errata/RHSA-2025:10926
- https://access.redhat.com/errata/RHSA-2025:10931
- https://access.redhat.com/errata/RHSA-2025:11636
- https://access.redhat.com/errata/RHSA-2025:11638
- https://access.redhat.com/errata/RHSA-2025:11639
- https://access.redhat.com/errata/RHSA-2025:11640
- https://access.redhat.com/errata/RHSA-2025:11645
- https://access.redhat.com/errata/RHSA-2025:2025
- https://access.redhat.com/errata/RHSA-2025:2026
- https://access.redhat.com/errata/RHSA-2025:2029
- https://access.redhat.com/security/cve/CVE-2024-10234
- https://bugzilla.redhat.com/show_bug.cgi?id=2320848
- https://access.redhat.com/security/updates/classification/#moderate
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11638.json
- https://www.cve.org/CVERecord?id=CVE-2024-10234
- https://nvd.nist.gov/vuln/detail/CVE-2024-10234
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11639.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11640.json
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0
- https://access.redhat.com/articles/7100706
- https://issues.redhat.com/browse/JBEAP-27764
- https://issues.redhat.com/browse/JBEAP-28389
- https://issues.redhat.com/browse/JBEAP-28402
- https://issues.redhat.com/browse/JBEAP-28774
- https://issues.redhat.com/browse/JBEAP-28836
- https://issues.redhat.com/browse/JBEAP-28845
- https://issues.redhat.com/browse/JBEAP-28880
- https://issues.redhat.com/browse/JBEAP-29009
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2025.json
- https://issues.redhat.com/browse/JBEAP-27765
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2026.json