CVE-2023-4503 is a medium severity (CVSS 6.8) improper initialization flaw in Galleon. Custom Red Hat JBoss EAP or EAP-XP servers provisioned with it are created unsecured, which could expose remote HTTP services. Apply the Red Hat errata for your product and review any custom provisioned server.
What's affected
The NVD record says that when Galleon is used to provision custom EAP or EAP-XP servers, the servers are created unsecured. That could let an attacker reach remote HTTP services available from the server.
The Red Hat CVE page we read links Bugzilla entry 2184751, titled eap-galleon: custom provisioning creates unsecured http-invoker, and classifies the flaw as CWE-665. The record lists several Red Hat errata (RHSA-2023:7637, 7638, 7639 and 7641) plus Red Hat Enterprise Linux and JBoss EAP product entries. We did not read the errata text, so look up which one matches your EAP version and stream before you act.
The point to notice is that the risk sits in servers built with a custom provisioning step, not in every EAP install. A standard installation from the product zip or from a stock image may not be affected in the same way, but confirm that in the errata.
How to check if you're exposed
List how each of your EAP servers was built. Servers assembled with Galleon feature packs or provisioning files are the ones to review first.
Then look at the running server for the HTTP invoker endpoint. A server that answers on that path without credentials needs attention right away.
Check the server version against the fixed versions in the Red Hat errata for your stream. The errata list the product and the build that contains the correction.
Review which network segments can reach the management and application ports of those servers.
What to do now
- Build a list of Galleon provisioned EAP and EAP-XP servers.
- Match each one to the right Red Hat errata and apply it, then rebuild provisioned images from fixed inputs.
- Restrict network access to the affected HTTP services while you patch.
- Add an authentication check for the invoker endpoint to your post deployment tests.
- Review server logs for requests to that endpoint from unexpected sources.
Why it matters
The weakness is CWE-665, improper initialization. A resource is created, but not with a safe default state. Here, the provisioning tool leaves an HTTP service without the security that a standard build would apply.
The score is medium because the attacker needs network reach and an affected build, but the result is a service that talks to anyone. Secure by default provisioning matters in build tooling, since one flawed template can produce many exposed servers. The record does not state exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Is every JBoss EAP install affected?
No. The record describes servers provisioned with Galleon in custom setups. Confirm your build method and the matching Red Hat errata.
Sources
Last reviewed: 19 October 2026.
