PT-2021-10080 · Red Hat · Wildfly

Pedro Sampaio · CVE-2020-1719 · Published 2021-06-07 · Updated 2024-03-06

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: wildfly versions prior to 20.0.0.Final

Description: A flaw was found in the EJBContext principle, which is not popped back after invoking another EJB using a different Security Domain. The highest threat from this issue is to data confidentiality and integrity.

Recommendations: For versions prior to 20.0.0.Final, update to wildfly 20.0.0.Final or later to resolve the issue. As a temporary workaround, consider restricting the use of EJBs with different Security Domains to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-270

Related Identifiers

BIT-WILDFLY-2020-1719

CVE-2020-1719

GHSA-P9CF-QJXQ-VXW6

RHSA-2020:2058

RHSA-2020:2059

RHSA-2020:2060

RHSA-2020:2511

RHSA-2020:2512

RHSA-2020:2513

Affected Products

Wildfly

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-1719 · Security Note
• https://osv.dev/vulnerability/BIT-wildfly-2020-1719 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1719 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9cf-qjxq-vxw6 · Vendor Advisory
• https://t.me/cvenotify/15737 · Telegram Post
• https://t.me/cvenotify/15725 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=1796617 · Note