CVE-2024-1233 — Eap: wildfly-elytron has a ssrf security issue
A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filterin…
Published: 2024-04-09 · CVSS: 7.3 · CVSS 3.1
A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7