CVE-2024-1233
- Source
- https://cve.org/CVERecord?id=CVE-2024-1233
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-1233.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-1233
- Aliases
- Downstream
CGA (6)
- Published
- 2024-04-09T07:01:47Z
- Modified
- 2026-10-16T02:54:09Z
- Severity
-
- 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- Eap: wildfly-elytron has a ssrf security issue
- Details
-
A flaw was found in
JwtValidator.resolvePublicKeyin JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability. - Database specific
{ "cna_assigner": "redhat", "cwe_ids": [ "CWE-918" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1233.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "fixed": "1.15.23.Final-redhat-00001" }, { "fixed": "0:3.0.1-4.b08_redhat_00005.1.ep7.el7" }, { "fixed": "0:5.1.17-3.Final_redhat_00004.1.ep7.el7" }, { "fixed": "0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7" }, { "fixed": "0:4.0.12-1.Final_redhat_00002.1.ep7.el7" }, { "fixed": "0:4.1.63-2.Final_redhat_00003.1.ep7.el7" }, { "fixed": "0:1.4.18-16.SP14_redhat_00001.1.ep7.el7" }, { "fixed": "0:7.1.11-4.GA_redhat_00002.1.ep7.el7" }, { "fixed": "0:1.1.14-1.Final_redhat_00001.1.ep7.el7" }, { "fixed": "0:1.0.21-1.Final_redhat_00001.1.ep7.el7" }, { "fixed": "0:1.0.13-1.Final_redhat_00001.1.ep7.el7" }, { "fixed": "0:1.0.12-1.Final_redhat_00001.1.ep7.el7" }, { "fixed": "0:1.0.12-6.Final_redhat_00001.1.ep7.el7" }, { "fixed": "0:2.10.4-3.redhat_00006.1.el7eap" }, { "fixed": "0:2.10.4-3.redhat_00006.1.el7eap" }, { "fixed": "0:2.10.4-5.redhat_00006.1.el7eap" }, { "fixed": "0:2.10.4-3.redhat_00006.1.el7eap" }, { "fixed": "0:2.10.4-5.redhat_00006.1.el7eap" }, { "fixed": "0:2.10.4-2.redhat_00006.1.el7eap" }, { "fixed": "0:1.7.2-16.Final_redhat_00017.1.el7eap" }, { "fixed": "0:4.1.63-5.Final_redhat_00003.1.el7eap" }, { "fixed": "0:2.0.41-4.SP5_redhat_00001.1.el7eap" }, { "fixed": "0:7.3.14-3.GA_redhat_00002.1.el7eap" }, { "fixed": "0:1.10.17-1.Final_redhat_00001.1.el7eap" }, { "fixed": "0:3.5.8-1.redhat_00001.1.el8eap" }, { "fixed": "0:3.3.22-1.Final_redhat_00001.1.el8eap" }, { "fixed": "0:11.0.19-2.Final_redhat_00001.1.el8eap" }, { "fixed": "0:4.0.54-3.Final_redhat_00001.1.el8eap" }, { "fixed": "0:3.0.0-8.SP08_redhat_00001.1.el8eap" }, { "fixed": "0:13.5.0-1.Final_redhat_00001.1.el8eap" }, { "fixed": "0:1.12.3-3.Final_redhat_00001.1.el8eap" }, { "fixed": "0:1.10.0-36.Final_redhat_00035.1.el8eap" }, { "fixed": "0:2.2.32-1.SP1_redhat_00001.1.el8eap" }, { "fixed": "0:7.4.17-2.GA_redhat_00002.1.el8eap" }, { "fixed": "0:1.2.4-1.Final_redhat_00001.1.el8eap" }, { "fixed": "0:1.15.23-2.Final_redhat_00001.1.el8eap" }, { "fixed": "0:1.1.17-1.Final_redhat_00002.1.el8eap" }, { "fixed": "0:1.1.19-1.Final_redhat_00001.1.el8eap" }, { "fixed": "0:2.4.3-1.redhat_00001.1.el8eap" }, { "fixed": "0:2.3.4-1.redhat_00002.1.el8eap" }, { "fixed": "0:3.5.8-1.redhat_00001.1.el9eap" }, { "fixed": "0:3.3.22-1.Final_redhat_00001.1.el9eap" }, { "fixed": "0:11.0.19-2.Final_redhat_00001.1.el9eap" }, { "fixed": "0:4.0.54-3.Final_redhat_00001.1.el9eap" }, { "fixed": "0:3.0.0-8.SP08_redhat_00001.1.el9eap" }, { "fixed": "0:13.5.0-1.Final_redhat_00001.1.el9eap" }, { "fixed": "0:1.12.3-3.Final_redhat_00001.1.el9eap" }, { "fixed": "0:1.10.0-36.Final_redhat_00035.1.el9eap" }, { "fixed": "0:2.2.32-1.SP1_redhat_00001.1.el9eap" }, { "fixed": "0:7.4.17-2.GA_redhat_00002.1.el9eap" }, { "fixed": "0:1.2.4-1.Final_redhat_00001.1.el9eap" }, { "fixed": "0:1.15.23-2.Final_redhat_00001.1.el9eap" }, { "fixed": "0:1.1.17-1.Final_redhat_00002.1.el9eap" }, { "fixed": "0:1.1.19-1.Final_redhat_00001.1.el9eap" }, { "fixed": "0:2.4.3-1.redhat_00001.1.el9eap" }, { "fixed": "0:2.3.4-1.redhat_00002.1.el9eap" }, { "fixed": "0:1.15.23-2.Final_redhat_00001.1.el7eap" }, { "fixed": "0:4.0.1-1.Final_redhat_00001.1.el8eap" }, { "fixed": "0:2.2.4-2.SP01_redhat_00001.1.el8eap" }, { "fixed": "0:4.0.1-1.Final_redhat_00001.1.el9eap" }, { "fixed": "0:2.2.4-2.SP01_redhat_00001.1.el9eap" } ], "source": "AFFECTED_FIELD", "strategy": "InverseAffectedRanges" } ] } ] }- References
-
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
- https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523
- https://issues.redhat.com/browse/WFLY-19226
- https://access.redhat.com/errata/RHSA-2024:3559
- https://access.redhat.com/errata/RHSA-2024:3560
- https://access.redhat.com/errata/RHSA-2024:3561
- https://access.redhat.com/errata/RHSA-2024:3563
- https://access.redhat.com/errata/RHSA-2024:3580
- https://access.redhat.com/errata/RHSA-2024:3581
- https://access.redhat.com/errata/RHSA-2024:3583
- https://access.redhat.com/errata/RHSA-2025:9582
- https://access.redhat.com/errata/RHSA-2025:9583
- https://access.redhat.com/security/cve/CVE-2024-1233
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1233.json
- https://github.com/advisories/GHSA-v4mm-q8fv-r2w5
- https://nvd.nist.gov/vuln/detail/CVE-2024-1233
- https://bugzilla.redhat.com/show_bug.cgi?id=2262849
- https://github.com/wildfly/wildfly
Affected packages
Git / github.com/wildfly/wildfly
Affected ranges
- Type
- GIT
- Repo
- https://github.com/wildfly/wildfly
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "32.0.0.Final" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }
Affected versions
10.*
10.0.0.Alpha1
10.0.0.Alpha2
10.0.0.Alpha3
10.0.0.Alpha4
10.0.0.Alpha5
10.0.0.Alpha6
10.0.0.Beta1
10.0.0.Beta2
10.0.0.CR1
10.0.0.CR2
10.0.0.CR3
10.0.0.CR4
10.0.0.CR5
10.0.0.Final
11.*
11.0.0.CR1
11.0.0.Final
12.*
12.0.0.Beta1
12.0.0.CR1
12.0.0.Final
13.*
13.0.0.Beta1
14.*
14.0.0.Beta1
14.0.0.Beta2
14.0.0.Final
15.*
15.0.0.Beta1
15.0.0.Final
16.*
16.0.0.Beta1
16.0.0.Final
17.*
17.0.0.Alpha1
17.0.0.Beta1
17.0.0.Final
18.*
18.0.0.Beta1
18.0.0.Final
19.*
19.0.0.Beta1
19.0.0.Beta2
20.*
20.0.0.Beta1
20.0.0.Final
21.*
21.0.0.Beta1
21.0.0.Final
22.*
22.0.0.Alpha1
22.0.0.Beta1
22.0.0.Final
23.*
23.0.0.Beta1
23.0.0.Final
24.*
24.0.0.Beta1
25.*
25.0.0.Beta1
25.0.0.Final
26.*
26.0.0.Beta1
27.*
27.0.0.Alpha1
27.0.0.Alpha2
27.0.0.Alpha3
27.0.0.Alpha4
27.0.0.Beta1
28.*
28.0.0.Beta1
28.0.0.Final
29.*
29.0.0.Alpha1
29.0.0.Beta1
29.0.0.Final
30.*
30.0.0.Beta1
30.0.0.Final
31.*
31.0.0.Beta1
31.0.0.Final
32.*
32.0.0.Beta1
7.*
7.0.0.Alpha1
7.0.0.Alpha1-final
7.0.0.Beta1-prerelease
7.0.0.Beta2
7.0.0.Beta2-prerelease
7.0.0.Beta3
7.0.0.CR1
7.0.0.Final
7.0.0.Final-prerelease
7.0.0.Final-prerelease2
7.0.0.Final-prerelease3
7.1.0.Alpha1
7.1.0.Beta1
7.1.0.CR1
7.1.0.Final
7.1.0.Final-prerelease
7.1.0.Final-prerelease2
7.1.1.Final
7.1.2-prerelease
7.1.2.Final
7.2.0.Final
7.2.0.Final-prerelease1
8.*
8.0.0.Alpha1
8.0.0.Alpha2
8.0.0.Alpha3
8.0.0.Alpha4
8.0.0.Beta1
8.0.0.CR1
8.0.0.Final
8.1.0.CR1
8.1.0.CR2
9.*
9.0.0.Beta1
9.0.0.Beta2
9.0.0.CR1
Other
Pre_EE10_Big_Bang