high7.5
CVE-2020-10714
Session Fixation in WildFly Elytron
Impact
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.wildfly.security:wildfly-elytron | <= 1.11.3 | 1.11.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Wildfly Elytron | before 1.11.3 |
| Redhat | Codeready Studio | Version 12.0 |
| Redhat | Descision Manager | Version 7.0 |
| Redhat | Jboss Fuse | Version 7.0.0 |
| Redhat | Process Automation | Version 7.0 |
| Netapp | Oncommand Insight | All versions |