PT-2020-12294 · Red Hat · Wildfly Elytron

Mark Banierink + 1 · Published 2020-09-23 · Updated 2022-11-08 · CVE-2020-10714

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WildFly Elytron versions 1.11.3.Final and earlier

Description A flaw was found in WildFly Elytron when using FORM authentication with a session ID in the URL, allowing an attacker to perform a session fixation attack. This poses a threat to data confidentiality and integrity, as well as system availability.

Recommendations For WildFly Elytron versions 1.11.3.Final and earlier, consider disabling the use of session IDs in URLs for FORM authentication until a patch is available. Restrict access to sensitive data and implement additional security measures to minimize the risk of session fixation attacks.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2020-10714

GHSA-7FHR-2694-RG79

RHSA-2020:3461

RHSA-2020:3462

RHSA-2020:3463

RHSA-2020:3637

RHSA-2020:3638

RHSA-2020:3639

Affected Products

Wildfly Elytron

References · 8

• https://bugzilla.redhat.com/show_bug.cgi?id=1825714 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7fhr-2694-rg79 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10714 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10714 · Vendor Advisory
• https://github.com/wildfly-security/wildfly-elytron · Note
• https://security.netapp.com/advisory/ntap-20201223-0002 · Note
• https://t.me/cvenotify/7626 · Telegram Post
• https://t.me/cvenotify/37265 · Telegram Post