What’s Vulnerable › Vulnerabilities

CVE-2023-4503: Eap-galleon: custom provisioning creates unsecured http-invoker

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-06 · updated 2026-06-17
• Weakness: CWE-665

Description

An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.

Affected products

• Red Hat JBoss EAP: 7.4
• RedHat Jboss Enterprise Application Platform Expansion Pack: all versions

References

• https://access.redhat.com/errata/RHSA-2023:7637
• https://access.redhat.com/errata/RHSA-2023:7638
• https://access.redhat.com/errata/RHSA-2023:7639
• https://access.redhat.com/errata/RHSA-2023:7641
• https://access.redhat.com/security/cve/CVE-2023-4503
• https://bugzilla.redhat.com/show_bug.cgi?id=2184751
• https://access.redhat.com/errata/RHSA-2023:7637
• https://access.redhat.com/errata/RHSA-2023:7638
• https://access.redhat.com/errata/RHSA-2023:7639
• https://access.redhat.com/errata/RHSA-2023:7641
• https://access.redhat.com/security/cve/CVE-2023-4503
• https://bugzilla.redhat.com/show_bug.cgi?id=2184751

Get alerted when CVE-2023-4503 or the next vulnerability affects your stack