Eap-galleon: custom provisioning creates unsecured http-invoker
Priority LOW 34CWE-665Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 7 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0072 54th percentileScored 2026-11-07
Fix Partial Red Hat: 7 advisoriesRed Hat: 7 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | EAP 7.4.14 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.2.28-1.SP1_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 7.4.14-5.GA_redhat_00002.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.2.28-1.SP1_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 7.4.14-5.GA_redhat_00002.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.2.28-1.SP1_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 7.4.14-5.GA_redhat_00002.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | No fix listed | CNA |
- EAP 7.4.14 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.28-1.SP1_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 7.4.14-5.GA_redhat_00002.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.28-1.SP1_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 7.4.14-5.GA_redhat_00002.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.28-1.SP1_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 7.4.14-5.GA_redhat_00002.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Running on | Red Hat |
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat
Remediation
Red Hat 7 advisories
- RHSA-2024:3580 Released 2024-06-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.2 Security update
- Red Hat JBoss EAP 8.0 for RHEL 8 eap8-activemq-artemis-2.21.0-4.redhat_00048.1.el8eap, eap8-activemq-artemis-cli-2.21.0-4.redhat_00048.1.el8eap, eap8-activemq-artemis-commons-2.21.0-4.redhat_00048.1.el8eap +47
- RHSA-2024:3581 Released 2024-06-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.2 Security update
- Red Hat JBoss EAP 8.0 for RHEL 9 eap8-activemq-artemis-2.21.0-4.redhat_00048.1.el9eap, eap8-activemq-artemis-cli-2.21.0-4.redhat_00048.1.el9eap, eap8-activemq-artemis-commons-2.21.0-4.redhat_00048.1.el9eap +47
- RHSA-2024:3583 Released 2024-06-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.2 Security update
- Red Hat JBoss Enterprise Application Platform 8
Show 4 more Red Hat advisories
- RHSA-2023:7638 Released 2023-12-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el8eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el8eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el8eap +47
- RHSA-2023:7641 Released 2023-12-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.14 security update
- Red Hat JBoss Enterprise Application Platform com.google.guava.guava-32.1.1.jre-redhat-00001.jar, io.netty.netty-codec-http2-4.1.94.Final-redhat-00003.jar, io.undertow.undertow-core-2.2.28.SP1-redhat-00001.jar +4
- RHSA-2023:7637 Released 2023-12-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el7eap +47
- RHSA-2023:7639 Released 2023-12-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 9 security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el9eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el9eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el9eap +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:7637 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:7638 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:7639 |
| Red Hat JBoss EAP 8.0 for RHEL 8 | Fixed | RHSA-2024:3580 |
| Red Hat JBoss EAP 8.0 for RHEL 9 | Fixed | RHSA-2024:3581 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2023:7641 |
| Red Hat JBoss Enterprise Application Platform 8 | Fixed | RHSA-2024:3583 |
Not affected: 4 products
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4503
- 2026-10-03 Alias added: GHSA-6c6r-r3r9-h62j
References
More Red Hat Jboss Enterprise Application Platform vulnerabilities
- TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
- TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
- TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-4503 · CVE Program
- CVE-2023-4503 · NVD
- FIRST EPSS
- GHSA-6c6r-r3r9-h62j · GitHub Advisory Database · CC BY 4.0
- CVE-2023-4503 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences