CVE-2024-10234: Wildfly: wildfly vulnerable to cross-site scripting (xss)

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-22 · updated 2026-08-19
Weakness: CWE-79

Description

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.

Affected products

Red Hat build of Keycloak 26.4: all versions
Red Hat JBoss EAP: 8.0

References

https://access.redhat.com/errata/RHSA-2025:10924
https://access.redhat.com/errata/RHSA-2025:10925
https://access.redhat.com/errata/RHSA-2025:10926
https://access.redhat.com/errata/RHSA-2025:10931
https://access.redhat.com/errata/RHSA-2025:11636
https://access.redhat.com/errata/RHSA-2025:11638
https://access.redhat.com/errata/RHSA-2025:11639
https://access.redhat.com/errata/RHSA-2025:11640
https://access.redhat.com/errata/RHSA-2025:11645
https://access.redhat.com/errata/RHSA-2025:2025
https://access.redhat.com/errata/RHSA-2025:2026
https://access.redhat.com/errata/RHSA-2025:2029

Get alerted when CVE-2024-10234 or the next vulnerability affects your stack