{"id":"CVE-2022-1278","aliases":["BIT-wildfly-2022-1278","EUVD-2022-6802","GHSA-fmq7-gh8v-mjvc"],"status":"published","title":"WildFly vulnerable to Insecure Default Initialization of Resource","description":"A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0088,"percentile":0.59364,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1188"],"published":"2022-09-13T13:38:02Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"Maven","package":"org.wildfly.bom:wildfly","fixed_in":["27.0.0.Beta1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"wildfly","fixed_in":["27.0.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.wildfly.bom:wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.0.0.Beta1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"wildfly","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"27.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.wildfly.bom:wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.0.0.Beta1"}]}],"versions":["11.0.0.Alpha1","11.0.0.Alpha2","11.0.0.Beta1","11.0.0.Beta2","11.0.0.Beta3","11.0.0.CR1","11.0.0.Final","12.0.0.CR1","12.0.0.Final","13.0.0.Alpha1","13.0.0.Alpha2","13.0.0.Alpha3","13.0.0.Alpha5","13.0.0.Final","14.0.0.Alpha1","14.0.0.Beta2","14.0.0.Final","14.0.1.Final","15.0.0.Beta1","15.0.0.Final","15.0.1.Final","16.0.0.Beta1","16.0.0.Final","17.0.0.Beta1","17.0.0.Final","17.0.1.Final","18.0.0.Beta1","18.0.0.Final","18.0.1.Final","19.0.0.Beta1","19.0.0.Beta2","19.0.0.Beta3","19.0.0.Final","19.0.1.Final","19.1.0.Final","20.0.0.Beta1","20.0.0.Final","20.0.1.Final","21.0.0.Beta1","21.0.0.Final","21.0.1.Final","21.0.2.Final","22.0.0.Alpha1","22.0.0.Beta1","22.0.0.Final","22.0.1.Final","23.0.0.Beta1","23.0.0.Final","23.0.1.Final","23.0.2.Final","24.0.0.Beta1","24.0.0.Final","24.0.0.SP1","24.0.1.Final","25.0.0.Beta1","25.0.0.Final","25.0.1.Final","26.0.0.Beta1","26.0.0.Final","26.0.1.Final","26.1.0.Beta1","26.1.0.Final","26.1.1.Final","26.1.2.Final","26.1.3.Final","27.0.0.Alpha4"]}],"products":[{"vendor":"red hat","product":"wildfly"},{"vendor":"redhat","product":"amq"},{"vendor":"redhat","product":"amq_online"},{"vendor":"redhat","product":"integration_camel_k"},{"vendor":"redhat","product":"integration_service_registry"},{"vendor":"redhat","product":"jboss_a-mq"},{"vendor":"redhat","product":"jboss_enterprise_application_platform_expansion_pack"},{"vendor":"redhat","product":"single_sign-on"},{"vendor":"redhat","product":"wildfly"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073401","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1278","tags":["web","advisory"]},{"url":"https://issues.redhat.com/browse/WFLY-16238","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fmq7-gh8v-mjvc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1278.json","tags":["advisory"]},{"url":"https://github.com/wildfly/boms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-1278","description":"A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.","status":"published","published":"2022-09-13T13:38:02Z","modified":"2024-08-02T23:55:24.61Z","cwes":["CWE-1188"],"updated_at":"2026-11-02T14:34:38.922686Z"}],"euvd":[{"id":"EUVD-2022-6802","description":"A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.","status":"published","published":"2022-09-13T13:38:02Z","modified":"2024-08-02T23:55:24Z","updated_at":"2026-11-03T03:26:01.998866Z"}],"ghsa":[{"id":"GHSA-fmq7-gh8v-mjvc","title":"WildFly vulnerable to Insecure Default Initialization of Resource","description":"A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.","status":"published","published":"2022-09-14T00:00:48Z","modified":"2023-01-27T05:02:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2022-1278","description":"A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.","status":"published","published":"2022-09-13T14:15:08.62Z","modified":"2026-06-17T04:22:08.36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"GHSA-fmq7-gh8v-mjvc","title":"WildFly vulnerable to Insecure Default Initialization of Resource","description":"A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.","status":"published","published":"2022-09-14T00:00:48Z","modified":"2023-12-06T01:01:51.527714Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"BIT-wildfly-2022-1278","description":"A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.","status":"published","published":"2024-03-06T11:08:21.462Z","modified":"2026-09-08T08:48:21.253539582Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CVE-2022-1278","description":"A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.","status":"published","published":"2022-09-13T13:38:02Z","modified":"2026-10-28T02:30:57.832471897Z","cwes":["CWE-1188"],"updated_at":"2026-11-02T15:44:23.245966Z"}]}}