CVE-2024-1233

Description

A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.

References

• Advisories
• More

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS