A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and…
Priority LOW 35CWE-1188Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 fixed, 16 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
Why it matters now
EPSS 0.0088 59th percentileScored 2026-11-07
Fix Partial org.wildfly.bom:wildfly (Maven): 27.0.0.Beta1Red Hat: 2 advisoriesRed Hat: 2 fixed, 16 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | WildFly | no fixed versions known | — | No fix listed | CNA |
| — | org.wildfly.bom:wildfly (Maven) | before 27.0.0.Beta1 | 27.0.0.Beta1 | Patch available | GHSA-fmq7-gh8v-mjvc |
- WildFly Vendor— Affected no fixed versions known Fixed in — No fix listed CNA
- org.wildfly.bom:wildfly (Maven) Vendor— Affected before 27.0.0.Beta1 Fixed in 27.0.0.Beta1 Patch available GHSA-fmq7-gh8v-mjvc
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* | before 27.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:amq:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:amq_online:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:* | 7 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* Versions before 27.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:amq:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:amq_online:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:* Versions 7 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-fmq7-gh8v-mjvc org.wildfly.bom:wildfly (Maven) Fixed in 27.0.0.Beta1 Advisory →
Red Hat 2 advisories
- RHSA-2023:1855 Released 2023-04-18 · Red Hat rating ModerateRed Hat JBoss EAP 7.4.10 XP 4.0.0.GA security release
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- RHSA-2023:1661 Released 2023-04-05 · Red Hat rating ImportantRed Hat AMQ Broker 7.11.0 release and security update
- AMQ Broker 7.11.0
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Decision Manager 7 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat Integration Data Virtualisation Operator | Affected | No fix planned: Out of support scope |
| Red Hat Integration Service Registry | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka | Affected | No fix yet: Fix deferred |
| AMQ Broker 7.11.0 | Fixed | RHSA-2023:1661 |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Fixed | RHSA-2023:1855 |
Not affected: 9 products
- A-MQ Clients 2
- Red Hat A-MQ Online
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat OpenShift Application Runtimes
- Red Hat Satellite 6
- Red Hat build of Apicurio Registry 2
- Red Hat build of Debezium 1
- Red Hat build of Quarkus
- Red Hat support for Spring Boot
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1278
- 2026-10-03 Alias added: GHSA-fmq7-gh8v-mjvc
References
More Red Hat Amq vulnerabilities
- TI-2015-04350 Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ. CVSS 3.1HIGH 8.8
- TI-2015-04351 Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ. CVSS 3.1HIGH 7.5
- TI-2015-04352 Console: CORS headers set to allow all in Red Hat AMQ. CVSS 3.1HIGH 7.5
- TI-2020-11178 A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with… CVSS 3.1MEDIUM 6.5
- TI-2020-11168 Uncontrolled resource consumption in Red Hat wildfly CVSS 3.1MEDIUM 6.5
Sources
- CVE-2022-1278 · CVE Program
- CVE-2022-1278 · NVD
- FIRST EPSS
- GHSA-fmq7-gh8v-mjvc · GitHub Advisory Database · CC BY 4.0
- CVE-2022-1278 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences