Medium severity · published Sep 4, 2018
CVE-2018-14627
The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required
5.9
CVSS
1.1%
EPSS
No
On KEV
Description
The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connections: <transport-config confidentiality="required" trust-in-target="supported"/>
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Wildfly · Redhat
before 14.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14627
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14627
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3527
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3528
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3529
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3595
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14627
Third Party Advisory
https://issues.jboss.org/browse/WFLY-9107
More from Wildfly
9.8
CVE-2018-10683
An issue was discovered in WildFly 10.1.2.Final
9.1
CVE-2019-14887
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored
8.8
CVE-2019-3894
It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as
7.5
CVE-2022-1278
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain
7.5
CVE-2020-10718
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL)