Red Hat JBoss Enterprise Application Platform 6 vulnerabilities

3 CVEs affecting Red Hat JBoss Enterprise Application Platform 6, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4639, published 2024-11-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-4639, published 2024-11-17. High severity, CVSS 7.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to…
CVE-2023-6717, published 2024-04-25. Medium severity, CVSS 6.0. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a…
CVE-2024-1249, published 2024-04-17. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in…