Stored cross-site scripting in Wildfly - CVE-2024-10234

Vulnerability identifier: #VU105956

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-10234

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in the user's browser.

Wildfly
JBoss Enterprise Application Platform
eap8-jboss-el (Red Hat package)
eap8-jcip-annotations (Red Hat package)
eap8-jul-to-slf4j-stub (Red Hat package)
eap8-gnu-getopt (Red Hat package)
eap8-jboss-stdio (Red Hat package)
eap8-javaewah (Red Hat package)
eap8-xml-commons-resolver (Red Hat package)
eap8-staxmapper (Red Hat package)
eap8-jboss-msc (Red Hat package)
eap8-wildfly-common (Red Hat package)
eap8-jboss-dmr (Red Hat package)
eap8-jackson-coreutils (Red Hat package)
eap8-json-patch (Red Hat package)
eap8-jboss-invocation (Red Hat package)
eap8-slf4j-jboss-logmanager (Red Hat package)
eap8-jboss-iiop-client (Red Hat package)
eap8-jboss-common-beans (Red Hat package)
eap8-artemis-wildfly-integration (Red Hat package)
eap8-jakarta-authorization-api (Red Hat package)
eap8-jboss-logmanager (Red Hat package)
eap8-h2database (Red Hat package)
eap8-reactivex-rxjava2 (Red Hat package)
eap8-jboss-ejb3-ext-api (Red Hat package)
eap8-jboss-aesh (Red Hat package)
eap8-jboss-threads (Red Hat package)
eap8-jbossws-api (Red Hat package)
eap8-jakarta-security-enterprise-api (Red Hat package)
eap8-jboss-genericjms (Red Hat package)
eap8-jakarta-authentication-api (Red Hat package)
eap8-jakarta-enterprise-concurrent (Red Hat package)
eap8-jakarta-enterprise-concurrent-api (Red Hat package)
eap8-jboss-remoting-jmx (Red Hat package)
eap8-jakarta-servlet-jsp-api (Red Hat package)
eap8-jboss-vfs (Red Hat package)
eap8-hal-console (Red Hat package)
eap8-jakarta-enterprise-lang-model (Red Hat package)
eap8-jbossws-spi (Red Hat package)
eap8-jbossws-common (Red Hat package)
eap8-hibernate-commons-annotations (Red Hat package)
eap8-woodstox-core (Red Hat package)
eap8-jbossws-cxf (Red Hat package)
eap8-jboss-transaction-spi (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-azure-storage (Red Hat package)
rh-sso7-keycloak (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)
Red Hat Single Sign-On

Install update from vendor's website.

Wildfly - update to 35.0.0
JBoss Enterprise Application Platform - update to 8.0.6
eap8-jboss-el (Red Hat package) - update to api_5.0_spec-4.0.1-2.Final_redhat_00001.1.el9eap
eap8-jcip-annotations (Red Hat package) - update to 1.0.0-2.redhat_8.1.el9eap
eap8-jul-to-slf4j-stub (Red Hat package) - update to 1.0.1-2.Final_redhat_3.1.el9eap
eap8-gnu-getopt (Red Hat package) - update to 1.0.13-2.redhat_5.1.el9eap
eap8-jboss-stdio (Red Hat package) - update to 1.1.0-2.Final_redhat_00001.1.el9eap
eap8-javaewah (Red Hat package) - update to 1.1.13-2.redhat_00001.1.el9eap
eap8-xml-commons-resolver (Red Hat package) - update to 1.2.0-3.redhat_12.1.el9eap
eap8-staxmapper (Red Hat package) - update to 1.4.0-2.Final_redhat_00001.1.el9eap
eap8-jboss-msc (Red Hat package) - update to 1.5.1-2.Final_redhat_00001.1.el9eap
eap8-wildfly-common (Red Hat package) - update to 1.6.0-4.Final_redhat_00001.1.el9eap
eap8-jboss-dmr (Red Hat package) - update to 1.6.1-2.Final_redhat_00001.1.el9eap
eap8-jackson-coreutils (Red Hat package) - update to 1.8.0-2.redhat_00002.1.el9eap
eap8-json-patch (Red Hat package) - update to 1.9.0-2.redhat_00002.1.el9eap
eap8-jboss-invocation (Red Hat package) - update to 2.0.0-2.Final_redhat_00001.1.el9eap
eap8-slf4j-jboss-logmanager (Red Hat package) - update to 2.0.1-2.Final_redhat_00001.1.el9eap
eap8-jboss-iiop-client (Red Hat package) - update to 2.0.1-2.Final_redhat_00001.1.el9eap
eap8-jboss-common-beans (Red Hat package) - update to 2.0.1-2.Final_redhat_00001.1.el9eap
eap8-artemis-wildfly-integration (Red Hat package) - update to 2.0.3-1.Final_redhat_00001.1.el9eap
eap8-jakarta-authorization-api (Red Hat package) - update to 2.1.0-3.redhat_00001.1.el9eap
eap8-jboss-logmanager (Red Hat package) - update to 2.1.19-2.Final_redhat_00001.1.el9eap
eap8-h2database (Red Hat package) - update to 2.1.214-2.redhat_00001.1.el9eap
eap8-reactivex-rxjava2 (Red Hat package) - update to 2.2.21-2.redhat_00001.2.el9eap
eap8-jboss-ejb3-ext-api (Red Hat package) - update to 2.3.0-2.Final_redhat_00001.1.el9eap
eap8-jboss-aesh (Red Hat package) - update to 2.4.0-2.redhat_00001.1.el9eap
eap8-jboss-threads (Red Hat package) - update to 2.4.0-3.Final_redhat_00001.1.el9eap
eap8-jbossws-api (Red Hat package) - update to 3.0.0-2.Final_redhat_00001.1.el9eap
eap8-jakarta-security-enterprise-api (Red Hat package) - update to 3.0.0-2.redhat_00001.1.el9eap
eap8-jboss-genericjms (Red Hat package) - update to 3.0.0-3.Final_redhat_00001.1.el9eap
eap8-jakarta-authentication-api (Red Hat package) - update to 3.0.0-3.redhat_00001.1.el9eap
eap8-jakarta-enterprise-concurrent (Red Hat package) - update to 3.0.0-4.redhat_00001.1.el9eap
eap8-jakarta-enterprise-concurrent-api (Red Hat package) - update to 3.0.2-2.redhat_00001.1.el9eap
eap8-jboss-remoting-jmx (Red Hat package) - update to 3.0.4-2.Final_redhat_00001.1.el9eap
eap8-jakarta-servlet-jsp-api (Red Hat package) - update to 3.1.0-3.redhat_00001.1.el9eap
eap8-jboss-vfs (Red Hat package) - update to 3.3.0-2.Final_redhat_00001.1.el9eap
eap8-hal-console (Red Hat package) - update to 3.6.23-1.Final_redhat_00001.1.el9eap
eap8-jakarta-enterprise-lang-model (Red Hat package) - update to 4.0.1-2.redhat_00001.1.el9eap
eap8-jbossws-spi (Red Hat package) - update to 5.0.0-2.Final_redhat_00001.1.el9eap
eap8-jbossws-common (Red Hat package) - update to 5.1.0-1.Final_redhat_00001.1.el9eap
eap8-hibernate-commons-annotations (Red Hat package) - update to 6.0.6-2.Final_redhat_00001.1.el9eap
eap8-woodstox-core (Red Hat package) - update to 6.4.0-3.redhat_00003.1.el9eap
eap8-jbossws-cxf (Red Hat package) - update to 7.3.1-1.Final_redhat_00001.1.el9eap
Red Hat Single Sign-On - update to 7.6.12
eap8-jboss-transaction-spi (Red Hat package) - update to 8.0.0-3.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - update to 8.0.6-5.GA_redhat_00004.1.el9eap
eap8-azure-storage (Red Hat package) - update to 8.6.6-5.redhat_00001.1.el9eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.19-1.redhat_00002.1.el7sso, 18.0.19-1.redhat_00002.1.el8sso, 18.0.19-1.redhat_00002.1.el9sso
eap8-eap-product-conf-parent (Red Hat package) - update to 800.6.0-2.GA_redhat_00002.1.el9eap

• https://github.com/wildfly/wildfly/releases/tag/35.0.0.Final
• https://github.com/advisories/GHSA-w22f-vwwp-37pr

• Multiple vulnerabilities in WildFly
• Red Hat JBoss Enterprise Application Platform 8.0 update for Wildfly
• Stored cross-site scripting in Red Hat Single Sign-On 7.6
• Stored cross-site scripting in Red Hat Single Sign-On 7.6
• Stored cross-site scripting in Red Hat Single Sign-On 7.6
• Stored cross-site scripting in Red Hat Single Sign-On 7.6