This security advisory for Red Hat JBoss Enterprise Application Platform 7.4.23 addresses several vulnerabilities: CVE-2024-10234 (WildFly XSS), CVE-2025-2251 (Improper Deserialization in JBoss Marshalling allowing remote code execution), CVE-2025-2901 (Stored XSS in JBoss EAP Management Console), CVE-2025-23184 (Denial of Service in Apache CXF), CVE-2025-35036 (Hibernate Validator Expression Language Injection), and CVE-2025-48734 (Apache Commons BeanUtils PropertyUtilsBean enum declaredClass property issue). These vulnerabilities impact multiple components within the platform and are fixed in this release. The advisory references Red Hat's errata RHSA-2025:10931 for detailed patch and upgrade instructions.

The vulnerabilities fixed in this update include Cross-Site Scripting (XSS) flaws that could allow attackers to execute malicious scripts in the context of the affected web interfaces, an Expression Language Injection that could lead to unauthorized expression evaluation, a Denial of Service vulnerability affecting Apache CXF, and an Improper Deserialization vulnerability that could enable remote code execution. These issues collectively pose significant risks including potential remote code execution, service disruption, and unauthorized access or manipulation of application data and management consoles.

A security update to Red Hat JBoss Enterprise Application Platform 7.4.23 is available and should be applied. This update replaces version 7.4.22 and includes fixes for all listed vulnerabilities. Before applying the update, ensure all previously released errata are applied and back up existing installations, including applications and configurations. Follow Red Hat's official guidance at https://access.redhat.com/articles/11258 for update procedures. No additional mitigation actions are indicated beyond applying this official update.