Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update

Fixed packages 49

Vulnerabilities 7

• High 8.8
  CVE-2025-48734 Public exploit

  Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

  Apache Software Foundation Apache Commons BeanUtils 1.x Apache Commons BeanUtils 2.x druid Debian Ubuntu Azure Linux Wolfi Maven
  May 28, 2025
• High 7.3
  CVE-2025-35036

  hibernate-validator insecure default Expression Language interpolation

  Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitr…

  Hibernate hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Ubuntu Maven
  Jun 3, 2025
• Medium 6.5
  CVE-2025-23366

  Org.jboss.hal:hal-console: wildfly hal console cross-site scripting

  A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a …

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8 Maven
  Jan 14, 2025
• Medium 6.2
  CVE-2025-2251

  Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution

  A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
  Apr 7, 2025
• Medium 6.1
  CVE-2024-10234

  Wildfly: wildfly vulnerable to cross-site scripting (xss)

  A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the …

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7
  Oct 22, 2024
• Medium 5.9
  CVE-2025-23184

  Apache CXF: Denial of Service vulnerability with temporary files

  A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies …

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  Jan 21, 2025
• Medium 4.6
  CVE-2025-2901 Rejected

  HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store

  This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234.

  org.jboss.hal:hal-console Maven
  Mar 28, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2320848
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2339095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2351678
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2355685
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2368956
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2370118
• article
  https://issues.redhat.com/browse/JBEAP-28676
• article
  https://issues.redhat.com/browse/JBEAP-28905
• article
  https://issues.redhat.com/browse/JBEAP-29217
• article
  https://issues.redhat.com/browse/JBEAP-29440
• article
  https://issues.redhat.com/browse/JBEAP-29815
• article
  https://issues.redhat.com/browse/JBEAP-29862
• article
  https://issues.redhat.com/browse/JBEAP-29866
• article
  https://issues.redhat.com/browse/JBEAP-29914
• article
  https://issues.redhat.com/browse/JBEAP-29969
• article
  https://issues.redhat.com/browse/JBEAP-30031
• article
  https://issues.redhat.com/browse/JBEAP-30059
• article
  https://issues.redhat.com/browse/JBEAP-30264
• article
  https://issues.redhat.com/browse/JBEAP-30359
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10924.json
• report
  https://access.redhat.com/security/cve/CVE-2024-10234
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-10234
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-10234
• report
  https://access.redhat.com/security/cve/CVE-2025-2251
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-2251
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-2251
• article
  https://github.com/wildfly/wildfly/pull/18872
• article
  https://github.com/wildfly/wildfly/releases/tag/36.0.0.Final
• article
  https://issues.redhat.com/browse/WFLY-20550
• report
  https://access.redhat.com/security/cve/CVE-2025-2901
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-2901
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-2901
• report
  https://access.redhat.com/security/cve/CVE-2025-23184
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-23184
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-23184
• article
  https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122