cve.bz

CVE-2024-1233

7.3 highEPSS 0.8%

High (7.3). EPSS 0.8% chance of exploitation in the next 30 days.

A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.

Severity

CVSS 3.1

7.3 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS
0.8% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE
CWE-918
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-v4mm-q8fv-r2w5Mavenorg.wildfly.security:wildfly-elytron-realm-token<=2.4.0.CR1no fix published

References

Check your stackJSON