High severity · published Sep 16, 2020
CVE-2020-1748
A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security…
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Decision Manager · Redhat
7.0 · source: NVD
PA
Process Automation · Redhat
7.0 · source: NVD
WE
Wildfly Elytron · Redhat
before 1.6.8.final-redhat-00001 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1748
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1748
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1807707
Third Party Advisory
https://security.netapp.com/advisory/ntap-20201001-0005/
More from Decision Manager
9.8
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using…
9.8
CVE-2018-19360
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic…
9.8
CVE-2018-19361
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization
9.8
CVE-2018-19362
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic…
8.8
CVE-2022-1415
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data