CVE-2024-10234 is an improper neutralization of input during web page generation vulnerability (cross-site scripting) in the Wildfly deployment system used by Red Hat JBoss Enterprise Application Platform 7.4. The vulnerability allows a user with deployment permissions to inject malicious scripts via deployment payloads, which can lead to execution of unintended actions on the server. The vulnerability affects version 35.0.0 of Wildfly as used in JBoss EAP 7.4. Red Hat has issued security advisories (RHSA-2025:10924 and RHSA-2025:10925) providing patches in JBoss Enterprise Application Platform 7.4.23 for RHEL 7 and RHEL 8. The advisories classify the update as important and provide detailed instructions for applying the fixes. No known exploits in the wild have been reported at this time.

The vulnerability allows an attacker or insider with deployment privileges to execute cross-site scripting attacks via malicious deployment payloads, potentially compromising confidentiality and integrity of the affected system. The CVSS 3.1 base score of 6.1 reflects a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed. There is no impact on availability. No active exploitation has been reported.

Red Hat has released official security updates in JBoss Enterprise Application Platform 7.4.23 for both RHEL 7 and RHEL 8 that address CVE-2024-10234. Users should apply these updates following Red Hat's guidance, ensuring all previously released errata are applied and backing up existing installations before updating. The vendor manages remediation through these official patches. No additional mitigation steps are required beyond applying the provided updates.