Org.wildfly.core:wildfly-server: wildfly improper rbac permission
Priority LOW 30CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.
Summary
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00769 55th percentileScored 2026-11-07
Fix Partial wildfly-core: 27.0.1.Final, 28.0.0.Beta2org.wildfly.core:wildfly-server (Maven): 27.0.1.Final, 28.0.0.Beta2Red Hat: 6 advisoriesRed Hat: 8 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | wildfly-core | before 27.0.1.Final; 28.0.0.Beta1 to before 28.0.0.Beta2 | 27.0.1.Final, 28.0.0.Beta2 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform | — | 15.0.45.Final-redhat-00001 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.22 | — | 15.0.42.Final-redhat-00001 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 4.1.119-1.Final_redhat_00004.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 4.1.119-1.Final_redhat_00004.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 7.4.21-3.GA_29548_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 4.1.119-1.Final_redhat_00004.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 4.1.119-1.Final_redhat_00004.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 7.4.21-3.GA_29548_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 4.1.119-1.Final_redhat_00004.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 4.1.119-1.Final_redhat_00004.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 7.4.21-3.GA_29548_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 2.16.1-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 1.80.0-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 800.7.0-2.GA_redhat_00002.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 6.2.35-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 3.0.13-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 3.0.1-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 4.0.11-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 1.0.4-3.redhat_00004.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 3.1.10-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 5.1.5-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 8.0.7-3.GA_redhat_00004.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 2.2.9-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 2.16.1-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 1.80.0-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 800.7.0-2.GA_redhat_00002.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 6.2.35-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 3.0.13-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 3.0.1-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 4.0.11-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 1.0.4-3.redhat_00004.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 3.1.10-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 5.1.5-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 8.0.7-3.GA_redhat_00004.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 2.2.9-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat Build of Keycloak | — | — | Not affected | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Fuse 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | Not affected | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | No fix listed | CNA |
| — | org.wildfly.core:wildfly-server (Maven) | before 27.0.1.Final | 27.0.1.Final | Patch available | GHSA-qr6x-62gq-4ccp |
| — | org.wildfly.core:wildfly-server (Maven) | 28.0.0.Beta1 to before 28.0.0.Beta2 | 28.0.0.Beta2 | Patch available | GHSA-qr6x-62gq-4ccp |
- wildfly-core Vendor— Affected before 27.0.1.Final; 28.0.0.Beta1 to before 28.0.0.Beta2 Fixed in 27.0.1.Final, 28.0.0.Beta2 Patch available CNA
- Red Hat JBoss Enterprise Application Platform VendorRed Hat Affected — Fixed in 15.0.45.Final-redhat-00001 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4.22 VendorRed Hat Affected — Fixed in 15.0.42.Final-redhat-00001 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 4.1.119-1.Final_redhat_00004.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 4.1.119-1.Final_redhat_00004.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 7.4.21-3.GA_29548_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 4.1.119-1.Final_redhat_00004.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 4.1.119-1.Final_redhat_00004.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 7.4.21-3.GA_29548_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 4.1.119-1.Final_redhat_00004.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 4.1.119-1.Final_redhat_00004.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 7.4.21-3.GA_29548_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 2.16.1-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 1.80.0-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 800.7.0-2.GA_redhat_00002.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 6.2.35-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 3.0.13-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 3.0.1-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 4.0.11-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 1.0.4-3.redhat_00004.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 3.1.10-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 5.1.5-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 8.0.7-3.GA_redhat_00004.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.9-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 2.16.1-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 1.80.0-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 800.7.0-2.GA_redhat_00002.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 6.2.35-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 3.0.13-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 3.0.1-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 4.0.11-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 1.0.4-3.redhat_00004.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 3.1.10-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 5.1.5-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 8.0.7-3.GA_redhat_00004.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.9-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- org.wildfly.core:wildfly-server (Maven) Vendor— Affected before 27.0.1.Final Fixed in 27.0.1.Final Patch available GHSA-qr6x-62gq-4ccp
- org.wildfly.core:wildfly-server (Maven) Vendor— Affected 28.0.0.Beta1 to before 28.0.0.Beta2 Fixed in 28.0.0.Beta2 Patch available GHSA-qr6x-62gq-4ccp
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:* | 7.4 to before 7.4.21; 8.0.0 to before 8.0.7 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* | before 27.0.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:wildfly:28.0.0:beta1:*:*:*:*:*:* | 28.0.0 beta1 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:* Versions 7.4 to before 7.4.21; 8.0.0 to before 8.0.7 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* Versions before 27.0.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:wildfly:28.0.0:beta1:*:*:*:*:*:* Versions 28.0.0 beta1 Vulnerable ·Red Hat
Remediation
- Fix · CNA wildfly-core Fixed in 27.0.1.Final, 28.0.0.Beta2
- Fix · GHSA-qr6x-62gq-4ccp org.wildfly.core:wildfly-server (Maven) Fixed in 27.0.1.Final Advisory →
- Fix · GHSA-qr6x-62gq-4ccp org.wildfly.core:wildfly-server (Maven) Fixed in 28.0.0.Beta2 Advisory →
Red Hat 6 advisories
- RHSA-2025:4552 Released 2025-05-06 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.22 security update
- Red Hat JBoss Enterprise Application Platform 7.4.22 commons-io.commons-io-2.16.1.redhat-00001.jar, io.netty.netty-common-4.1.119.Final-redhat-00004.jar, io.netty.netty-handler-4.1.119.Final-redhat-00004.jar +1
- RHSA-2025:3992 Released 2025-04-17 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.7 security update
- Red Hat JBoss Enterprise Application Platform 8
- RHSA-2025:3990 Released 2025-04-17 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.7 security update
- Red Hat JBoss EAP 8.0 for RHEL 9 eap8-apache-commons-io-2.16.1-1.redhat_00001.1.el9eap, eap8-bouncycastle-1.80.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-jmail-1.80.0-1.redhat_00001.1.el9eap +36
Show 3 more Red Hat advisories
- RHSA-2025:3989 Released 2025-04-17 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.7 security update
- Red Hat JBoss EAP 8.0 for RHEL 8 eap8-apache-commons-io-2.16.1-1.redhat_00001.1.el8eap, eap8-bouncycastle-1.80.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-jmail-1.80.0-1.redhat_00001.1.el8eap +36
- RHSA-2025:3465 Released 2025-04-01 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.21 security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-netty-4.1.119-1.Final_redhat_00004.1.el7eap, eap7-netty-all-4.1.119-1.Final_redhat_00004.1.el7eap, eap7-netty-buffer-4.1.119-1.Final_redhat_00004.1.el7eap +29
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-netty-4.1.119-1.Final_redhat_00004.1.el8eap, eap7-netty-all-4.1.119-1.Final_redhat_00004.1.el8eap, eap7-netty-buffer-4.1.119-1.Final_redhat_00004.1.el8eap +30
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-netty-4.1.119-1.Final_redhat_00004.1.el9eap, eap7-netty-buffer-4.1.119-1.Final_redhat_00004.1.el9eap, eap7-netty-codec-4.1.119-1.Final_redhat_00004.1.el9eap +29
- RHSA-2025:3467 Released 2025-04-01 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.21 security update
- Red Hat JBoss Enterprise Application Platform com.fasterxml.jackson.core.jackson-core-2.12.7.SP1-redhat-00001.jar, commons-beanutils.commons-beanutils-1.11.0.redhat-00001.jar, io.netty.netty-common-4.1.124.Final-redhat-00001.jar +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2025:3465 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2025:3465 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2025:3465 |
| Red Hat JBoss EAP 8.0 for RHEL 8 | Fixed | RHSA-2025:3989 |
| Red Hat JBoss EAP 8.0 for RHEL 9 | Fixed | RHSA-2025:3990 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2025:3467 |
| Red Hat JBoss Enterprise Application Platform 7.4.22 | Fixed | RHSA-2025:4552 |
| Red Hat JBoss Enterprise Application Platform 8 | Fixed | RHSA-2025:3992 |
Not affected: 4 products
- Red Hat Build of Keycloak
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 7.4.22
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2025-23367
- 2026-10-03 Alias added: GHSA-qr6x-62gq-4ccp
References
Advisory 10
More Red Hat Jboss Enterprise Application Platform vulnerabilities
- TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
- TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
- TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-23367 · CVE Program
- CVE-2025-23367 · NVD
- FIRST EPSS
- GHSA-qr6x-62gq-4ccp · GitHub Advisory Database · CC BY 4.0
- CVE-2025-23367 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences