Description

A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.

INFO

Published Date :

2024-04-09T07:01:47.673Z

Last Modified :

2025-12-01T12:49:56.281Z

Source :

redhat
AFFECTED PRODUCTS

The following products are affected by CVE-2024-1233 vulnerability.

Vendors Products
Redhat
  • Jboss Enterprise Application Platform
  • Jboss Enterprise Application Platform Eus
  • Jbosseapxp
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-1233.

URL Resource
https://access.redhat.com/errata/RHSA-2024:3559 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:3560 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:3561 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:3563 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:3580 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:3581 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:3583 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:9582 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:9583 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2024-1233 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2262849 cve-icon cve-icon
https://github.com/advisories/GHSA-v4mm-q8fv-r2w5 cve-icon cve-icon cve-icon
https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523 cve-icon cve-icon cve-icon
https://issues.redhat.com/browse/WFLY-19226 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-1233 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-1233 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact