This security advisory for Red Hat JBoss Enterprise Application Platform 7.4.23 addresses seven CVEs affecting various components of the platform. The vulnerabilities include CVE-2024-10234 (WildFly Cross-Site Scripting), CVE-2025-2251 (Improper Deserialization in JBoss Marshalling allowing remote code execution), CVE-2025-2901 (Stored XSS in JBoss EAP Management Console), CVE-2025-23184 (Denial of Service in Apache CXF), CVE-2025-35036 (Hibernate Validator Expression Language Injection), and CVE-2025-48734 (Apache Commons BeanUtils PropertyUtilsBean issue). The update fixes these issues by upgrading affected components and applying patches. The advisory does not provide CVSS scores but rates the update as important. The vendor has released an official fix for these vulnerabilities.

The vulnerabilities fixed in this update could allow attackers to perform Cross-Site Scripting attacks, potentially leading to unauthorized script execution in the context of the affected web applications. The improper deserialization vulnerability could allow remote code execution, posing a critical risk. The Denial of Service vulnerability could disrupt service availability. Expression Language Injection could allow attackers to execute arbitrary expressions, potentially leading to unauthorized actions. Overall, these vulnerabilities pose significant security risks to affected Red Hat JBoss Enterprise Application Platform 7.4 deployments if left unpatched.

An official security update is available in Red Hat JBoss Enterprise Application Platform 7.4.23, which addresses all listed vulnerabilities. Users should apply this update promptly after ensuring all previous errata are applied and backing up their systems, including applications, configuration files, and databases. No additional vendor mitigation or workaround is indicated in the advisory.