Skip to main content

Jboss Enterprise Application Platform Expansion Pack CVE-2022-1278

HIGH
Initialization of a Resource with an Insecure Default (CWE-1188)
2022-09-13 secalert@redhat.com
Information Disclosure Red Hat Jboss Enterprise Application Platform Expansion Pack Single Sign On Wildfly Jboss A Mq Integration Camel K Integration Service Registry Amq Amq Online
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 13, 2022 - 14:15 nvd
HIGH 7.5

DescriptionNVD

A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.

AnalysisAI

A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1188. A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain. Affected products include: Redhat Wildfly, Redhat Amq, Redhat Amq Online, Redhat Integration Camel K, Redhat Integration Service Registry.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Jboss Enterprise Application Platform Expansion Pack

View all
CVE-2022-0853 HIGH POC
7.5 Mar 11

A flaw was found in JBoss-client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authent
CVE-2025-12543 CRITICAL
9.6 Jan 07

Undertow HTTP server (used in WildFly, JBoss EAP) fails to validate Host headers, enabling cache poisoning, internal net
CVE-2026-3009 HIGH
8.1 Mar 05

Keycloak's IdentityBrokerService.performLogin endpoint fails to enforce disabled Identity Provider restrictions, allowin
CVE-2025-9784 HIGH
7.5 Sep 02

Undertow, a Java web server used across Red Hat's JBoss Enterprise Application Platform, Fuse, and other middleware prod
CVE-2023-1108 HIGH
7.5 Sep 14

A flaw was found in undertow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
CVE-2025-5731 MEDIUM
5.5 Jun 26

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed

CVE-2021-3642 MEDIUM
5.3 Aug 05

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final

CVE-2021-20250 MEDIUM
4.3 May 13

A flaw was found in wildfly. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack co

Same weakness CWE-1188 – Initialization of a Resource with an Insecure Default

View all
CVE-2017-4971 MEDIUM
5.9
CVE-2026-66066 CRITICAL POC
9.5
CVE-2023-27524 CRITICAL POC
9.8
CVE-2022-24706 CRITICAL POC
9.8
CVE-2017-7964 CRITICAL POC
10.0
CVE-2017-8218 CRITICAL POC
9.8
CVE-2026-28775 CRITICAL POC
9.8
CVE-2025-70998 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2022-1278 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy