CVE-2020-10714

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Published: Sep 23, 2020
Updated: May 9, 2024
CVE: CVE-2020-10714
GHSA: GHSA-7fhr-2694-rg79
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P

CWEs:

CWE-384

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
redhat / wildfly_elytron	-	1.11.3
redhat / jboss_fuse	7.0.0	7.0.0.x
redhat / process_automation	7.0	7.0.x
redhat / descision_manager	7.0	7.0.x
redhat / codeready_studio	12.0	12.0.x
org.wildfly.security / wildfly-elytron	-	1.11.4

https://bugzilla.redhat.com/show_bug.cgi?id=1825714
https://security.netapp.com/advisory/ntap-20201223-0002/

Vulnerability Database

CVE-2020-10714

Deep Security Visibility Without the Complexity