Red Hat Red Hat Jboss Enterprise Application Platform 7.4 For Rhel 8
19 CVEs affecting Red Hat Red Hat Jboss Enterprise Application Platform 7.4 For Rhel 8. Latest disclosed: 2025-04-07. Critical: 0, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1973 | High | 7.5 | 2024-11-07 | A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, le… |
CVE-2024-7885 | High | 7.5 | 2024-08-21 | A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs wh… |
CVE-2024-5971 | High | 7.5 | 2024-07-08 | A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client woul… |
CVE-2023-5685 | High | 7.5 | 2024-03-22 | A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can… |
CVE-2024-1635 | High | 7.5 | 2024-02-19 | A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and… |
CVE-2023-3171 | High | 7.5 | 2023-12-27 | A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed… |
CVE-2023-3223 | High | 7.5 | 2023-09-27 | A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorize… |
CVE-2023-1108 | High | 7.5 | 2023-09-14 | A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the lo… |
CVE-2023-4639 | High | 7.4 | 2024-11-17 | A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacke… |
CVE-2024-1233 | High | 7.3 | 2024-04-09 | A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting… |
CVE-2023-4503 | Medium | 6.8 | 2024-02-06 | An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured… |
CVE-2025-23367 | Medium | 6.5 | 2025-01-30 | A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role… |
CVE-2025-23366 | Medium | 6.5 | 2025-01-14 | A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed… |
CVE-2023-4061 | Medium | 6.5 | 2023-11-08 | A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildf… |
CVE-2025-2251 | Medium | 6.2 | 2025-04-07 | A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulne… |
CVE-2024-10234 | Medium | 6.1 | 2024-10-22 | A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider t… |
CVE-2024-3653 | Medium | 5.3 | 2024-07-08 | A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the… |
CVE-2024-1459 | Medium | 5.3 | 2024-02-12 | A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an a… |
CVE-2024-4029 | Medium | 4.1 | 2024-05-02 | A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause… |