We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Ok

THREATINT
PUBLISHED

CVE-2024-1233

Jboss eap: wildfly-elytron has a ssrf security issue

Reserved:2024-02-05
Published:2024-04-09
Updated:2024-05-14

Description

A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.



HIGH: 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Problem types

Server-Side Request Forgery (SSRF)

Product status

Default status
affected

Default status
affected

Default status
affected

Timeline

2024-02-05:Reported to Red Hat.
2024-04-02:Made public.

Credits

Red Hat would like to thank Jingcheng Yang and Jianjun Chen from Sichuan University and Zhongguancun Lab for reporting this issue.

References

https://access.redhat.com/security/cve/CVE-2024-1233 vdb-entry

https://bugzilla.redhat.com/show_bug.cgi?id=2262849 (RHBZ#2262849) issue-tracking

cve.org CVE-2024-1233

nvd.nist.gov CVE-2024-1233

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-1233