CVE-2020-10714

moderate-risk
Published 2020-09-23

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Do I need to act?

-
0.37% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / HIGH complexity

Affected Products (6)

Wildfly Elytron
Codeready Studio
Descision Manager

Affected Vendors

Redhat Netapp

References (4)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1825714
Third Party Advisory https://security.netapp.com/advisory/ntap-20201223-0002/
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1825714
Third Party Advisory https://security.netapp.com/advisory/ntap-20201223-0002/
36
/ 100
moderate-risk
Severity 22/34 · High
Exploitability 1/34 · Minimal
Exposure 13/34 · Low