Multiple vulnerabilities in WildFly

Published: 2025-03-24 | Updated: 2025-03-24

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-10234 CVE-2024-51127
CWE-ID	CWE-79 CWE-378
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Wildfly Server applications / Frameworks for developing and running applications
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Stored cross-site scripting

EUVDB-ID: #VU105956

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-10234

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in the user's browser.

Mitigation

Vulnerable software versions

Wildfly: 20.0.0 - 34.0.1

CPE2.3

External links

https://github.com/wildfly/wildfly/releases/tag/35.0.0.Final
https://github.com/advisories/GHSA-w22f-vwwp-37pr

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Creation of temporary file with insecure permissions

EUVDB-ID: #VU101867

Risk: Low

CVSSv4.0: 5.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-51127

CWE-ID: CWE-378 - Creation of Temporary File With Insecure Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an error within the createTempFile method. A local user can overwrite arbitrary files on the system and potentially escalate privileges.