Description
A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | wildfly | 35.0.0 – < 35.0.0 | 35.0.0 |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | — |
| Red Hat | RHEL-8 based Middleware Containers | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.19-1.redhat_00002.1.el7sso | RHSA-2025:11640, RHSA-2025:11639, RHSA-2025:11638 |
| Red Hat JBoss EAP 8 | eap8-artemis-wildfly-integration | 2.0.3-1.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-azure-storage | 8.6.6-5.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.6.0-2.GA_redhat_00002.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-gnu-getopt | 1.0.13-2.redhat_5.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-h2database | 2.1.214-2.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-hal-console | 3.6.23-1.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-hibernate-commons-annotations | 6.0.6-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jackson-coreutils | 1.8.0-2.redhat_00002.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jakarta-authentication-api | 3.0.0-3.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jakarta-authorization-api | 2.1.0-3.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jakarta-enterprise-cdi-api +1 | 4.0.1-2.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jakarta-enterprise-concurrent | 3.0.0-4.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jakarta-enterprise-concurrent-api | 3.0.2-2.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jakarta-security-enterprise-api | 3.0.0-2.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jakarta-servlet-jsp-api | 3.1.0-3.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-javaewah | 1.1.13-2.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-aesh | 2.4.0-2.redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-dmr | 1.6.1-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-ejb3-ext-api | 2.3.0-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-el-api_5.0_spec | 4.0.1-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-genericjms | 3.0.0-3.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-iiop-client +2 | 2.0.1-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-invocation | 2.0.0-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-logmanager | 2.1.19-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-msc | 1.5.1-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-remoting-jmx | 3.0.4-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-stdio | 1.1.0-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-threads | 2.4.0-3.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-transaction-spi | 8.0.0-3.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jboss-vfs | 3.3.0-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jbossws-api | 3.0.0-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jbossws-common | 5.1.0-1.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jbossws-cxf | 7.3.1-1.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jbossws-spi | 5.0.0-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jcip-annotations | 1.0.0-2.redhat_8.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-json-patch | 1.9.0-2.redhat_00002.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-jul-to-slf4j-stub | 1.0.1-2.Final_redhat_3.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava2 | 2.2.21-2.redhat_00001.2.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-staxmapper | 1.4.0-2.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.6-5.GA_redhat_00004.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-wildfly-common | 1.6.0-4.Final_redhat_00001.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-woodstox-core | 6.4.0-3.redhat_00003.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 8 | eap8-xml-resolver +1 | 1.2.0-3.redhat_12.1.el8eap | RHSA-2025:2026, RHSA-2025:2025 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-21.redhat_00055.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.5.10-1.redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1:1.0.2-5.redhat_00004.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.9.6-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.14-9.SP10_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.27-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.23-3.SP2_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.21-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-42.Final_redhat_00042.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.15-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.23-3.GA_redhat_00002.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.26-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.23-3.GA_redhat_00002.1.el8eap | RHSA-2025:10926, RHSA-2025:10925 |
Advisories 9
- RHSA-2025:10926 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10925 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10924 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:2026 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.6 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2025:2025 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.6 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2025:11640 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.12 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2025:11638 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.12 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2025:11639 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.12 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Aug 19, 2026
- WID-SEC-2024-3249 Red Hat JBoss Enterprise Application Platform (Wildfly): Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Jul 27, 2025
References
- RHSA-2025:10924 vendor-advisory
- RHSA-2025:10925 vendor-advisory
- RHSA-2025:10926 vendor-advisory
- RHSA-2025:10931 vendor-advisory
- RHSA-2025:11636 vendor-advisory
- RHSA-2025:11638 vendor-advisory
- RHSA-2025:11639 vendor-advisory
- RHSA-2025:11640 vendor-advisory
- RHSA-2025:11645 vendor-advisory
- RHSA-2025:2025 vendor-advisory
- RHSA-2025:2026 vendor-advisory
- RHSA-2025:2029 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-10234 vdb-entry
- RHBZ#2320848 issue-tracking