CVE-2024-10234
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.
Risk Assessment
The risk includes the possibility of executing malicious scripts in the server context, which could lead to system integrity compromise or data theft. The attack can be performed by an insider or an attacker with access to the deployment system.
Recommendation
It is recommended to update Wildfly to a patched version and validate/sanitize input in the deployment process. Also restrict access to the deployment system.
Other vulnerabilities in Wildfly
See all- CVE-2026-15567High
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.
- CVE-2026-17614Medium
A path traversal flaw in WildFly's domain mode implementation allows a remote attacker who has obtained the slave host controller secret or compromised a slave host controller to supply a crafted relative path containing directory traversal sequences, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information.
- CVE-2025-23367Medium
A flaw in the Wildfly Server Role Based Access Control (RBAC) provider allows a user without the required privileges to suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks.
- CVE-2025-23366Medium
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups "SuperUser", "Admin", or "Maintainer".
Original NVD description (English source)
A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.