CVE-2022-1278
WildFly vulnerable to Insecure Default Initialization of Resource
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
- Record
CVE-2022-1278- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
CVE List No score
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
- Record
CVE-2022-1278- Weakness
- CWE-1188
- Updated
- 2026-11-02
EUVDEUVD-2022-6802 No score
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
- Record
EUVD-2022-6802- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fmq7-gh8v-mjvc
WildFly vulnerable to Insecure Default Initialization of Resource
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
- Record
GHSA-fmq7-gh8v-mjvc- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
OSVGHSA-fmq7-gh8v-mjvc
WildFly vulnerable to Insecure Default Initialization of Resource
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
- Record
GHSA-fmq7-gh8v-mjvc- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
OSVBIT-wildfly-2022-1278 No score
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
- Record
BIT-wildfly-2022-1278- Updated
- 2026-11-02
OSV No score
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
- Record
CVE-2022-1278- Weakness
- CWE-1188
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.wildfly.bom:wildflyMaven |
before 27.0.0.Beta1 | 27.0.0.Beta1 |
wildflyBitnami |
before 27.0.0 | 27.0.0 |
org.wildfly.bom:wildflyMaven |
before 27.0.0.Beta1, plus listed versions 11.0.0.Alpha111.0.0.Alpha211.0.0.Beta111.0.0.Beta211.0.0.Beta3 Show 45 moreShow less11.0.0.CR111.0.0.Final12.0.0.CR112.0.0.Final13.0.0.Alpha113.0.0.Alpha213.0.0.Alpha313.0.0.Alpha513.0.0.Final14.0.0.Alpha114.0.0.Beta214.0.0.Final14.0.1.Final15.0.0.Beta115.0.0.Final15.0.1.Final16.0.0.Beta116.0.0.Final17.0.0.Beta117.0.0.Final17.0.1.Final18.0.0.Beta118.0.0.Final18.0.1.Final19.0.0.Beta119.0.0.Beta219.0.0.Beta319.0.0.Final19.0.1.Final19.1.0.Final20.0.0.Beta120.0.0.Final20.0.1.Final21.0.0.Beta121.0.0.Final21.0.1.Final21.0.2.Final22.0.0.Alpha122.0.0.Beta122.0.0.Final22.0.1.Final23.0.0.Beta123.0.0.Final23.0.1.Final23.0.2.Final |
27.0.0.Beta1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-1278 is a high vulnerability (CVSS 7.5) in Red Hat Wildfly, published September 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in org.wildfly.bom:wildfly 27.0.0.Beta1.
References
Left out here: 16 versions. The JSON record has them.