Medium severity · published Nov 24, 2020
CVE-2020-25640
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in…
5.3
CVSS
1.3%
EPSS
No
On KEV
Description
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Wildfly · Redhat
before 21.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25640
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25640
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1881637
Third Party Advisory
https://github.com/amqphub/amqp-10-resource-adapter/issues/13
Third Party Advisory
https://security.netapp.com/advisory/ntap-20201210-0001/
More from Wildfly
9.8
CVE-2018-10683
An issue was discovered in WildFly 10.1.2.Final
9.1
CVE-2019-14887
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored
8.8
CVE-2019-3894
It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as
7.5
CVE-2022-1278
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain
7.5
CVE-2020-10718
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL)