vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2024-10234

Wildfly: wildfly vulnerable to cross-site scripting (xss)

HIGH
7.3
CVSS Score
Published: October 22, 2024 at 01:17 PM UTC
Updated: August 19, 2026 at 01:16 AM UTC
3 products affected across 2 vendorsJBoss Enterprise Application PlatformBuild of KeycloakWildfly

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.3
Exploit prediction
EPSS 0.7%
SSVC
No known exploit

Description

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Build of Keycloak· Red Hatcontainer
95%
All versions
JBoss Enterprise Application Platform· Red Hatrpm
95%
8.0
Vendor states this is fixed in 0:1.0.0-2.redhat_8.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.0.0-2.redhat_8.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.0.1-2.Final_redhat_3.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.0.1-2.Final_redhat_3.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.0.13-2.redhat_5.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.0.13-2.redhat_5.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.1.0-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.1.0-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.1.13-2.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.1.13-2.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.10.0-42.Final_redhat_00042.1.el7eap (unaffected)
Vendor states this is fixed in 0:1.10.0-42.Final_redhat_00042.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.10.0-42.Final_redhat_00042.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.15.26-1.Final_redhat_00001.1.el7eap (unaffected)
Vendor states this is fixed in 0:1.15.26-1.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.15.26-1.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.2.0-3.redhat_12.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.2.0-3.redhat_12.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.4.0-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.4.0-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.5.1-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.5.1-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.5.21-1.Final_redhat_00001.1.el7eap (unaffected)
Vendor states this is fixed in 0:1.5.21-1.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.5.21-1.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.6.0-4.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.6.0-4.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.6.1-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.6.1-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.8.0-2.redhat_00002.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.8.0-2.redhat_00002.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.9.0-2.redhat_00002.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.9.0-2.redhat_00002.1.el9eap (unaffected)
Vendor states this is fixed in 0:1.9.6-1.Final_redhat_00001.1.el7eap (unaffected)
Vendor states this is fixed in 0:1.9.6-1.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:1.9.6-1.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.0.0-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.0.0-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.0.1-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.0.1-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.0.3-1.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.0.3-1.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.1.0-3.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.1.0-3.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.1.19-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.1.19-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.1.214-2.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.1.214-2.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.16.0-21.redhat_00055.1.el7eap (unaffected)
Vendor states this is fixed in 0:2.16.0-21.redhat_00055.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.16.0-21.redhat_00055.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.2.21-2.redhat_00001.2.el8eap (unaffected)
Vendor states this is fixed in 0:2.2.21-2.redhat_00001.2.el9eap (unaffected)
Vendor states this is fixed in 0:2.3.0-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.3.0-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.3.14-9.SP10_redhat_00001.1.el7eap (unaffected)
Vendor states this is fixed in 0:2.3.14-9.SP10_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.3.14-9.SP10_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.4.0-2.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.4.0-2.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:2.4.0-3.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:2.4.0-3.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.0.0-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.0.0-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.0.0-2.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.0.0-2.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.0.0-3.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.0.0-3.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.0.0-3.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.0.0-3.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.0.0-4.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.0.0-4.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.0.2-2.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.0.2-2.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.0.4-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.0.4-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.1.0-3.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.1.0-3.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.3.0-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.3.0-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.3.27-1.Final_redhat_00001.1.el7eap (unaffected)
Vendor states this is fixed in 0:3.3.27-1.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.3.27-1.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.5.10-1.redhat_00001.1.el7eap (unaffected)
Vendor states this is fixed in 0:3.5.10-1.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.5.10-1.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:3.6.23-1.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:3.6.23-1.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:4.0.1-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:4.0.1-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:4.0.1-2.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:4.0.1-2.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:5.0.0-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:5.0.0-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:5.1.0-1.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:5.1.0-1.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:5.4.15-1.Final_redhat_00001.1.el7eap (unaffected)
Vendor states this is fixed in 0:5.4.15-1.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:5.4.15-1.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:6.0.23-3.SP2_redhat_00001.1.el7eap (unaffected)
Vendor states this is fixed in 0:6.0.23-3.SP2_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:6.0.23-3.SP2_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:6.0.6-2.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:6.0.6-2.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:6.4.0-3.redhat_00003.1.el8eap (unaffected)
Vendor states this is fixed in 0:6.4.0-3.redhat_00003.1.el9eap (unaffected)
Vendor states this is fixed in 0:7.3.1-1.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:7.3.1-1.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:7.4.23-3.GA_redhat_00002.1.el7eap (unaffected)
Vendor states this is fixed in 0:7.4.23-3.GA_redhat_00002.1.el8eap (unaffected)
Vendor states this is fixed in 0:7.4.23-3.GA_redhat_00002.1.el9eap (unaffected)
Vendor states this is fixed in 0:8.0.0-3.Final_redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:8.0.0-3.Final_redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:8.0.6-5.GA_redhat_00004.1.el8eap (unaffected)
Vendor states this is fixed in 0:8.0.6-5.GA_redhat_00004.1.el9eap (unaffected)
Vendor states this is fixed in 0:8.6.6-5.redhat_00001.1.el8eap (unaffected)
Vendor states this is fixed in 0:8.6.6-5.redhat_00001.1.el9eap (unaffected)
Vendor states this is fixed in 0:800.6.0-2.GA_redhat_00002.1.el8eap (unaffected)
Vendor states this is fixed in 0:800.6.0-2.GA_redhat_00002.1.el9eap (unaffected)
Vendor states this is fixed in 1:1.0.2-5.redhat_00004.1.el7eap (unaffected)
Vendor states this is fixed in 1:1.0.2-5.redhat_00004.1.el8eap (unaffected)
Vendor states this is fixed in 1:1.0.2-5.redhat_00004.1.el9eap (unaffected)
Vendor states this is fixed in 7.4 (unaffected)
Wildfly· Wildfly
85%
All versions

References (14)

Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2025:10924
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2025:10925
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2025:10926
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2025:10931
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2025:11636
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2025:11638
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2025:11639
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2025:11640

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.3HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card