CVE-2024-10234: Wildfly: wildfly vulnerable to cross-site scripting (xss)

Modified

AliasesRHSA-2025:11638RHSA-2025:11639RHSA-2025:11640+2 more

Published 22-10-2024Last modified 19-08-2026

Vulnerability summary

CVE-2024-10234 is a high (CVSS 7.3) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 52.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.3/10

010

High · v3.1 (NVD)

EPSS score

0.68%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3

RHSA-2025:10924 RHSA-2025:10925 RHSA-2025:10926

Timeline

22-10-2024
PublishedVulnerability first disclosed.
19-08-2026
Last modifiedVulnerability information updated.

Description

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.

CVSS metrics

3 scores · 3 sources · 1 version

v3.17.3

EPSS trend

Probability

0.68%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.68% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, administrative account, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat56 products

build_of_keycloakna
jboss_enterprise_application_platform8.0
eap8-artemis-wildfly-integration< 0:2.0.3-1.Final_redhat_00001.1.el8eap | < 0:2.0.3-1.Final_redhat_00001.1.el9eap
eap8-azure-storage< 0:8.6.6-5.redhat_00001.1.el8eap | < 0:8.6.6-5.redhat_00001.1.el9eap
eap8-eap-product-conf-parent< 0:800.6.0-2.GA_redhat_00002.1.el8eap | < 0:800.6.0-2.GA_redhat_00002.1.el9eap

eap8-eap-product-conf-wildfly-ee-feature-pack< 0:800.6.0-2.GA_redhat_00002.1.el8eap | < 0:800.6.0-2.GA_redhat_00002.1.el9eap
eap8-gnu-getopt< 0:1.0.13-2.redhat_5.1.el8eap | < 0:1.0.13-2.redhat_5.1.el9eap
eap8-h2database< 0:2.1.214-2.redhat_00001.1.el8eap | < 0:2.1.214-2.redhat_00001.1.el9eap
eap8-hal-console< 0:3.6.23-1.Final_redhat_00001.1.el8eap | < 0:3.6.23-1.Final_redhat_00001.1.el9eap
eap8-hibernate-commons-annotations< 0:6.0.6-2.Final_redhat_00001.1.el8eap | < 0:6.0.6-2.Final_redhat_00001.1.el9eap
eap8-jackson-coreutils< 0:1.8.0-2.redhat_00002.1.el8eap | < 0:1.8.0-2.redhat_00002.1.el9eap
eap8-jakarta-authentication-api< 0:3.0.0-3.redhat_00001.1.el8eap | < 0:3.0.0-3.redhat_00001.1.el9eap
eap8-jakarta-authorization-api< 0:2.1.0-3.redhat_00001.1.el8eap | < 0:2.1.0-3.redhat_00001.1.el9eap
eap8-jakarta-enterprise-cdi-api< 0:4.0.1-2.redhat_00001.1.el8eap | < 0:4.0.1-2.redhat_00001.1.el9eap
eap8-jakarta-enterprise-concurrent< 0:3.0.0-4.redhat_00001.1.el8eap | < 0:3.0.0-4.redhat_00001.1.el9eap
eap8-jakarta-enterprise-concurrent-api< 0:3.0.2-2.redhat_00001.1.el8eap | < 0:3.0.2-2.redhat_00001.1.el9eap
eap8-jakarta-enterprise-lang-model< 0:4.0.1-2.redhat_00001.1.el8eap | < 0:4.0.1-2.redhat_00001.1.el9eap
eap8-jakarta-security-enterprise-api< 0:3.0.0-2.redhat_00001.1.el8eap | < 0:3.0.0-2.redhat_00001.1.el9eap
eap8-jakarta-servlet-jsp-api< 0:3.1.0-3.redhat_00001.1.el8eap | < 0:3.1.0-3.redhat_00001.1.el9eap
eap8-javaewah< 0:1.1.13-2.redhat_00001.1.el8eap | < 0:1.1.13-2.redhat_00001.1.el9eap
eap8-jboss-aesh< 0:2.4.0-2.redhat_00001.1.el8eap | < 0:2.4.0-2.redhat_00001.1.el9eap
eap8-jboss-common-beans< 0:2.0.1-2.Final_redhat_00001.1.el8eap | < 0:2.0.1-2.Final_redhat_00001.1.el9eap
eap8-jboss-dmr< 0:1.6.1-2.Final_redhat_00001.1.el8eap | < 0:1.6.1-2.Final_redhat_00001.1.el9eap
eap8-jboss-ejb3-ext-api< 0:2.3.0-2.Final_redhat_00001.1.el8eap | < 0:2.3.0-2.Final_redhat_00001.1.el9eap
eap8-jboss-el-api_5.0_spec< 0:4.0.1-2.Final_redhat_00001.1.el8eap | < 0:4.0.1-2.Final_redhat_00001.1.el9eap
eap8-jboss-genericjms< 0:3.0.0-3.Final_redhat_00001.1.el8eap | < 0:3.0.0-3.Final_redhat_00001.1.el9eap
eap8-jboss-iiop-client< 0:2.0.1-2.Final_redhat_00001.1.el8eap | < 0:2.0.1-2.Final_redhat_00001.1.el9eap
eap8-jboss-invocation< 0:2.0.0-2.Final_redhat_00001.1.el8eap | < 0:2.0.0-2.Final_redhat_00001.1.el9eap
eap8-jboss-logmanager< 0:2.1.19-2.Final_redhat_00001.1.el8eap | < 0:2.1.19-2.Final_redhat_00001.1.el9eap
eap8-jboss-msc< 0:1.5.1-2.Final_redhat_00001.1.el8eap | < 0:1.5.1-2.Final_redhat_00001.1.el9eap
eap8-jboss-remoting-jmx< 0:3.0.4-2.Final_redhat_00001.1.el8eap | < 0:3.0.4-2.Final_redhat_00001.1.el9eap
eap8-jboss-stdio< 0:1.1.0-2.Final_redhat_00001.1.el8eap | < 0:1.1.0-2.Final_redhat_00001.1.el9eap
eap8-jboss-threads< 0:2.4.0-3.Final_redhat_00001.1.el8eap | < 0:2.4.0-3.Final_redhat_00001.1.el9eap
eap8-jboss-transaction-spi< 0:8.0.0-3.Final_redhat_00001.1.el8eap | < 0:8.0.0-3.Final_redhat_00001.1.el9eap
eap8-jboss-vfs< 0:3.3.0-2.Final_redhat_00001.1.el8eap | < 0:3.3.0-2.Final_redhat_00001.1.el9eap
eap8-jbossws-api< 0:3.0.0-2.Final_redhat_00001.1.el8eap | < 0:3.0.0-2.Final_redhat_00001.1.el9eap
eap8-jbossws-common< 0:5.1.0-1.Final_redhat_00001.1.el8eap | < 0:5.1.0-1.Final_redhat_00001.1.el9eap
eap8-jbossws-cxf< 0:7.3.1-1.Final_redhat_00001.1.el8eap | < 0:7.3.1-1.Final_redhat_00001.1.el9eap
eap8-jbossws-spi< 0:5.0.0-2.Final_redhat_00001.1.el8eap | < 0:5.0.0-2.Final_redhat_00001.1.el9eap
eap8-jcip-annotations< 0:1.0.0-2.redhat_8.1.el8eap | < 0:1.0.0-2.redhat_8.1.el9eap
eap8-json-patch< 0:1.9.0-2.redhat_00002.1.el8eap | < 0:1.9.0-2.redhat_00002.1.el9eap
eap8-jul-to-slf4j-stub< 0:1.0.1-2.Final_redhat_3.1.el8eap | < 0:1.0.1-2.Final_redhat_3.1.el9eap
eap8-reactivex-rxjava2< 0:2.2.21-2.redhat_00001.2.el8eap | < 0:2.2.21-2.redhat_00001.2.el9eap
eap8-slf4j-jboss-logmanager< 0:2.0.1-2.Final_redhat_00001.1.el8eap | < 0:2.0.1-2.Final_redhat_00001.1.el9eap
eap8-staxmapper< 0:1.4.0-2.Final_redhat_00001.1.el8eap | < 0:1.4.0-2.Final_redhat_00001.1.el9eap
eap8-wildfly< 0:8.0.6-5.GA_redhat_00004.1.el8eap | < 0:8.0.6-5.GA_redhat_00004.1.el9eap
eap8-wildfly-common< 0:1.6.0-4.Final_redhat_00001.1.el8eap | < 0:1.6.0-4.Final_redhat_00001.1.el9eap
eap8-wildfly-java-jdk11< 0:8.0.6-5.GA_redhat_00004.1.el8eap | < 0:8.0.6-5.GA_redhat_00004.1.el9eap
eap8-wildfly-java-jdk17< 0:8.0.6-5.GA_redhat_00004.1.el8eap | < 0:8.0.6-5.GA_redhat_00004.1.el9eap
eap8-wildfly-java-jdk21< 0:8.0.6-5.GA_redhat_00004.1.el8eap | < 0:8.0.6-5.GA_redhat_00004.1.el9eap
eap8-wildfly-modules< 0:8.0.6-5.GA_redhat_00004.1.el8eap | < 0:8.0.6-5.GA_redhat_00004.1.el9eap
eap8-woodstox-core< 0:6.4.0-3.redhat_00003.1.el8eap | < 0:6.4.0-3.redhat_00003.1.el9eap
eap8-xml-commons-resolver< 0:1.2.0-3.redhat_12.1.el8eap | < 0:1.2.0-3.redhat_12.1.el9eap
eap8-xml-resolver< 0:1.2.0-3.redhat_12.1.el8eap | < 0:1.2.0-3.redhat_12.1.el9eap
rh-sso7-keycloak< 0:18.0.19-1.redhat_00002.1.el7sso | < 0:18.0.19-1.redhat_00002.1.el8sso | < 0:18.0.19-1.redhat_00002.1.el9sso
rh-sso7-keycloak-server< 0:18.0.19-1.redhat_00002.1.el7sso | < 0:18.0.19-1.redhat_00002.1.el8sso | < 0:18.0.19-1.redhat_00002.1.el9sso

Show all 56

1 vendor · 56 products

References

33 links

access.redhat.com/errata/RHSA-2025:10924Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2025:10925Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2025:10926Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2025:10931Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2025:11636Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2025:11638Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2025:11639Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2025:11640Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2025:11645Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2025:2025Vendor AdvisoryX Refsource REDHATAdvisory

Show all 33 references

access.redhat.com/errata/RHSA-2025:2026Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2025:2029Vendor AdvisoryX Refsource REDHAT
access.redhat.com/security/cve/CVE-2024-10234VDB EntryX Refsource REDHATREPORTVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=2320848Issue TrackingX Refsource REDHATREPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11638.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2024-10234Advisory
nvd.nist.gov/vuln/detail/CVE-2024-10234Advisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11639.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11640.jsonAdvisory
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0ARTICLE
access.redhat.com/articles/7100706ARTICLE
issues.redhat.com/browse/JBEAP-27764ARTICLE
issues.redhat.com/browse/JBEAP-28389ARTICLE
issues.redhat.com/browse/JBEAP-28402ARTICLE
issues.redhat.com/browse/JBEAP-28774ARTICLE
issues.redhat.com/browse/JBEAP-28836ARTICLE
issues.redhat.com/browse/JBEAP-28845ARTICLE
issues.redhat.com/browse/JBEAP-28880ARTICLE
issues.redhat.com/browse/JBEAP-29009ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2025.jsonAdvisory
issues.redhat.com/browse/JBEAP-27765ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2026.jsonAdvisory