Red Hat JBoss Enterprise Application Platform vulnerabilities

5 CVEs affecting Red Hat JBoss Enterprise Application Platform, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-3653, published 2024-07-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-5685, published 2024-03-22. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management…
CVE-2024-5971, published 2024-07-08. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not…
CVE-2024-3653, published 2024-07-08. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler…
CVE-2024-1233, published 2024-04-09. High severity, CVSS 7.3. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is…
CVE-2024-4029, published 2024-05-02. Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile…