Skip to content
Fencer Vulns
medium 6.1

CVE-2024-10234 json

Wildfly: wildfly vulnerable to cross-site scripting (xss)

published 2024-10-22 2 y ago modified 2026-08-19 2 mo ago also EUVD-2024-33579

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.

Patch / fix

  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:1.5.21-1.Final_redhat_00001.1.el8eap, 0:1.9.6-1.Final_redhat_00001.1.el8eap, 0:1.10.0-42.Final_redhat_00042.1.el8eap, 0:1.15.26-1.Final_redhat_00001.1.el8eap, 0:2.3.14-9.SP10_redhat_00001.1.el8eap, 0:2.16.0-21.redhat_00055.1.el8eap, 0:3.3.27-1.Final_redhat_00001.1.el8eap, 0:3.5.10-1.redhat_00001.1.el8eap, 0:5.4.15-1.Final_redhat_00001.1.el8eap, 0:6.0.23-3.SP2_redhat_00001.1.el8eap, 0:7.4.23-3.GA_redhat_00002.1.el8eap, 1:1.0.2-5.redhat_00004.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 0:1.5.21-1.Final_redhat_00001.1.el9eap, 0:1.9.6-1.Final_redhat_00001.1.el9eap, 0:1.10.0-42.Final_redhat_00042.1.el9eap, 0:1.15.26-1.Final_redhat_00001.1.el9eap, 0:2.3.14-9.SP10_redhat_00001.1.el9eap, 0:2.16.0-21.redhat_00055.1.el9eap, 0:3.3.27-1.Final_redhat_00001.1.el9eap, 0:3.5.10-1.redhat_00001.1.el9eap, 0:5.4.15-1.Final_redhat_00001.1.el9eap, 0:6.0.23-3.SP2_redhat_00001.1.el9eap, 0:7.4.23-3.GA_redhat_00002.1.el9eap, 1:1.0.2-5.redhat_00004.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 0:1.5.21-1.Final_redhat_00001.1.el7eap, 0:1.9.6-1.Final_redhat_00001.1.el7eap, 0:1.10.0-42.Final_redhat_00042.1.el7eap, 0:1.15.26-1.Final_redhat_00001.1.el7eap, 0:2.3.14-9.SP10_redhat_00001.1.el7eap, 0:2.16.0-21.redhat_00055.1.el7eap, 0:3.3.27-1.Final_redhat_00001.1.el7eap, 0:3.5.10-1.redhat_00001.1.el7eap, 0:5.4.15-1.Final_redhat_00001.1.el7eap, 0:6.0.23-3.SP2_redhat_00001.1.el7eap, 0:7.4.23-3.GA_redhat_00002.1.el7eap, 1:1.0.2-5.redhat_00004.1.el7eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:1.0.13-2.redhat_5.1.el8eap, 0:1.1.13-2.redhat_00001.1.el8eap, 0:1.6.1-2.Final_redhat_00001.1.el8eap, 0:1.8.0-2.redhat_00002.1.el8eap, 0:2.0.1-2.Final_redhat_00001.1.el8eap, 0:2.0.3-1.Final_redhat_00001.1.el8eap, 0:2.1.0-3.redhat_00001.1.el8eap, 0:2.1.214-2.redhat_00001.1.el8eap, 0:2.3.0-2.Final_redhat_00001.1.el8eap, 0:2.4.0-2.redhat_00001.1.el8eap, 0:3.0.0-2.redhat_00001.1.el8eap, 0:3.0.0-3.redhat_00001.1.el8eap, 0:3.0.0-4.redhat_00001.1.el8eap, 0:3.0.2-2.redhat_00001.1.el8eap, 0:3.1.0-3.redhat_00001.1.el8eap, 0:3.6.23-1.Final_redhat_00001.1.el8eap, 0:4.0.1-2.redhat_00001.1.el8eap, 0:6.0.6-2.Final_redhat_00001.1.el8eap, 0:8.6.6-5.redhat_00001.1.el8eap, 0:800.6.0-2.GA_redhat_00002.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:1.0.13-2.redhat_5.1.el9eap, 0:1.1.13-2.redhat_00001.1.el9eap, 0:1.6.1-2.Final_redhat_00001.1.el9eap, 0:1.8.0-2.redhat_00002.1.el9eap, 0:2.0.1-2.Final_redhat_00001.1.el9eap, 0:2.0.3-1.Final_redhat_00001.1.el9eap, 0:2.1.0-3.redhat_00001.1.el9eap, 0:2.1.214-2.redhat_00001.1.el9eap, 0:2.3.0-2.Final_redhat_00001.1.el9eap, 0:2.4.0-2.redhat_00001.1.el9eap, 0:3.0.0-2.redhat_00001.1.el9eap, 0:3.0.0-3.redhat_00001.1.el9eap, 0:3.0.0-4.redhat_00001.1.el9eap, 0:3.0.2-2.redhat_00001.1.el9eap, 0:3.1.0-3.redhat_00001.1.el9eap, 0:3.6.23-1.Final_redhat_00001.1.el9eap, 0:4.0.1-2.redhat_00001.1.el9eap, 0:6.0.6-2.Final_redhat_00001.1.el9eap, 0:8.6.6-5.redhat_00001.1.el9eap, 0:800.6.0-2.GA_redhat_00002.1.el9eap
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 0:18.0.19-1.redhat_00002.1.el7sso
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 8 0:18.0.19-1.redhat_00002.1.el8sso
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 9 0:18.0.19-1.redhat_00002.1.el9sso
  • Red Hat RHEL-8 based Middleware Containers 7.6-67
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.19-1.redhat_00002.1.el9sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.19-1.redhat_00002.1.el9sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.19-1.redhat_00002.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.19-1.redhat_00002.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.19-1.redhat_00002.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.19-1.redhat_00002.1.el7sso
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.23-3.GA_redhat_00002.1.el9eap
  • eap7-apache-cxf jboss enterprise application platform 7.4 3.5.10-1.redhat_00001.1.el9eap

red hat advisories RHSA-2025:11640RHSA-2025:11639RHSA-2025:11638RHSA-2025:10926RHSA-2025:10925RHSA-2025:10924

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-10234 updated cvss 6.1

wildfly: Wildfly vulnerable to Cross-Site Scripting (XSS)

  • Red Hat Build of Keycloak wildfly-core-management-subsystem
    affected: no fix planned “Will not fix”
  • Red Hat Fuse 7 wildfly-core-management-subsystem Red Hat JBoss Data Grid 7 wildfly-core-management-subsystem
    affected: no fix planned “Out of support scope”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-67
    fixed: vendor fix RHSA-2025:11636
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-cxf 3.5.10-1.redhat_00001.1.el7eap, eap7-wildfly 7.4.23-3.GA_redhat_00002.1.el7eap, eap7-apache-cxf-rt 3.5.10-1.redhat_00001.1.el7eap, eap7-artemis-native 1.0.2-5.redhat_00004.1.el7eap, eap7-apache-cxf-tools 3.5.10-1.redhat_00001.1.el7eap, eap7-elytron-web 1.9.6-1.Final_redhat_00001.1.el7eap, +42 more
    fixed: vendor fix RHSA-2025:10924
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-cxf 3.5.10-1.redhat_00001.1.el8eap, eap7-wildfly 7.4.23-3.GA_redhat_00002.1.el8eap, eap7-apache-cxf-rt 3.5.10-1.redhat_00001.1.el8eap, eap7-artemis-native 1.0.2-5.redhat_00004.1.el8eap, eap7-apache-cxf-tools 3.5.10-1.redhat_00001.1.el8eap, eap7-elytron-web 1.9.6-1.Final_redhat_00001.1.el8eap, +43 more
    fixed: vendor fix RHSA-2025:10925
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-cxf 3.5.10-1.redhat_00001.1.el9eap, eap7-wildfly 7.4.23-3.GA_redhat_00002.1.el9eap, eap7-apache-cxf-rt 3.5.10-1.redhat_00001.1.el9eap, eap7-artemis-native 1.0.2-5.redhat_00004.1.el9eap, eap7-apache-cxf-tools 3.5.10-1.redhat_00001.1.el9eap, eap7-elytron-web 1.9.6-1.Final_redhat_00001.1.el9eap, +43 more
    fixed: vendor fix RHSA-2025:10926
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-gnu-getopt 1.0.13-2.redhat_5.1.el8eap, eap8-javaewah 1.1.13-2.redhat_00001.1.el8eap, eap8-xml-resolver 1.2.0-3.redhat_12.1.el8eap, eap8-jboss-aesh 2.4.0-2.redhat_00001.1.el8eap, eap8-json-patch 1.9.0-2.redhat_00002.1.el8eap, eap8-wildfly 8.0.6-5.GA_redhat_00004.1.el8eap, +46 more
    fixed: vendor fix RHSA-2025:2025
  • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-gnu-getopt 1.0.13-2.redhat_5.1.el9eap, eap8-javaewah 1.1.13-2.redhat_00001.1.el9eap, eap8-xml-resolver 1.2.0-3.redhat_12.1.el9eap, eap8-jboss-aesh 2.4.0-2.redhat_00001.1.el9eap, eap8-json-patch 1.9.0-2.redhat_00002.1.el9eap, eap8-wildfly 8.0.6-5.GA_redhat_00004.1.el9eap, +46 more
    fixed: vendor fix RHSA-2025:2026
show 7 more
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2025:10931
  • Red Hat JBoss Enterprise Application Platform 8
    fixed: vendor fix RHSA-2025:2029
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2025:11645
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.19-1.redhat_00002.1.el7sso, rh-sso7-keycloak-server 18.0.19-1.redhat_00002.1.el7sso
    fixed: vendor fix RHSA-2025:11638
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.19-1.redhat_00002.1.el8sso, rh-sso7-keycloak-server 18.0.19-1.redhat_00002.1.el8sso
    fixed: vendor fix RHSA-2025:11639
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.19-1.redhat_00002.1.el9sso, rh-sso7-keycloak-server 18.0.19-1.redhat_00002.1.el9sso
    fixed: vendor fix RHSA-2025:11640
  • Red Hat JBoss Enterprise Application Platform Expansion Pack wildfly-core-management-subsystem
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
NVD 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected products

  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 7
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 8
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 9
  • Red Hat RHEL-8 based Middleware Containers
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.