7.3
High
CVE-2024-1233 A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP…
Description
A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 1.15 | earliest → < 1.15.23.Final-redhat-00001 | 1.15.23.Final-redhat-00001 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | Versions not published |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published |
References
- RHSA-2024:3559 access.redhat.com
- RHSA-2024:3560 access.redhat.com
- RHSA-2024:3561 access.redhat.com
- RHSA-2024:3563 access.redhat.com
- RHSA-2024:3580 access.redhat.com
- RHSA-2024:3581 access.redhat.com
- RHSA-2024:3583 access.redhat.com
- RHSA-2025:9582 access.redhat.com
- RHSA-2025:9583 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2262849 bugzilla.redhat.com
- github.com github.com
- github.com github.com
- issues.redhat.com issues.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat JBoss Enterprise Application Platform
The 14 CVEs of Red Hat JBoss Enterprise Application Platform →
CVE-2026-0603
Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection
8.3
High
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.6
Critical
CVE-2024-3884
Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
High
CVE-2025-9784
Undertow: undertow madeyoureset http/2 ddos vulnerability
7.5
High