CVE-2020-10714
First published: Mon Apr 20 2020(Updated: )
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/eap7-dom4j | <0:2.1.3-1.redhat_00001.1.el6ea | 0:2.1.3-1.redhat_00001.1.el6ea |
| redhat/eap7-elytron-web | <0:1.2.5-1.Final_redhat_00001.1.el6ea | 0:1.2.5-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-glassfish-jsf | <0:2.3.5-13.SP3_redhat_00011.1.el6ea | 0:2.3.5-13.SP3_redhat_00011.1.el6ea |
| redhat/eap7-hal-console | <0:3.0.23-1.Final_redhat_00001.1.el6ea | 0:3.0.23-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-hibernate | <0:5.3.17-1.Final_redhat_00001.1.el6ea | 0:5.3.17-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-hibernate-validator | <0:6.0.20-1.Final_redhat_00001.1.el6ea | 0:6.0.20-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-ironjacamar | <0:1.4.22-1.Final_redhat_00001.1.el6ea | 0:1.4.22-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jackson-databind | <0:2.9.10.4-1.redhat_00001.1.el6ea | 0:2.9.10.4-1.redhat_00001.1.el6ea |
| redhat/eap7-jboss-genericjms | <0:2.0.6-1.Final_redhat_00001.1.el6ea | 0:2.0.6-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-logmanager | <0:2.1.15-1.Final_redhat_00001.1.el6ea | 0:2.1.15-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-modules | <0:1.8.10-1.Final_redhat_00001.1.el6ea | 0:1.8.10-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-server-migration | <0:1.3.1-13.Final_redhat_00014.1.el6ea | 0:1.3.1-13.Final_redhat_00014.1.el6ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.6-4.SP3_redhat_00001.1.el6ea | 0:3.7.6-4.SP3_redhat_00001.1.el6ea |
| redhat/eap7-resteasy | <0:3.6.1-10.SP9_redhat_00001.1.el6ea | 0:3.6.1-10.SP9_redhat_00001.1.el6ea |
| redhat/eap7-undertow | <0:2.0.30-4.SP4_redhat_00001.1.el6ea | 0:2.0.30-4.SP4_redhat_00001.1.el6ea |
| redhat/eap7-weld-core | <0:3.0.6-4.Final_redhat_00004.1.el6ea | 0:3.0.6-4.Final_redhat_00004.1.el6ea |
| redhat/eap7-wildfly | <0:7.2.9-4.GA_redhat_00003.1.el6ea | 0:7.2.9-4.GA_redhat_00003.1.el6ea |
| redhat/eap7-wildfly-elytron | <0:1.6.8-1.Final_redhat_00001.1.el6ea | 0:1.6.8-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-wildfly-http-client | <0:1.0.22-1.Final_redhat_00001.1.el6ea | 0:1.0.22-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-wildfly-transaction-client | <0:1.1.11-1.Final_redhat_00001.1.el6ea | 0:1.1.11-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-dom4j | <0:2.1.3-1.redhat_00001.1.el7ea | 0:2.1.3-1.redhat_00001.1.el7ea |
| redhat/eap7-elytron-web | <0:1.2.5-1.Final_redhat_00001.1.el7ea | 0:1.2.5-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-glassfish-jsf | <0:2.3.5-13.SP3_redhat_00011.1.el7ea | 0:2.3.5-13.SP3_redhat_00011.1.el7ea |
| redhat/eap7-hal-console | <0:3.0.23-1.Final_redhat_00001.1.el7ea | 0:3.0.23-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-hibernate | <0:5.3.17-1.Final_redhat_00001.1.el7ea | 0:5.3.17-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-hibernate-validator | <0:6.0.20-1.Final_redhat_00001.1.el7ea | 0:6.0.20-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-ironjacamar | <0:1.4.22-1.Final_redhat_00001.1.el7ea | 0:1.4.22-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jackson-databind | <0:2.9.10.4-1.redhat_00001.1.el7ea | 0:2.9.10.4-1.redhat_00001.1.el7ea |
| redhat/eap7-jboss-genericjms | <0:2.0.6-1.Final_redhat_00001.1.el7ea | 0:2.0.6-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-logmanager | <0:2.1.15-1.Final_redhat_00001.1.el7ea | 0:2.1.15-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-modules | <0:1.8.10-1.Final_redhat_00001.1.el7ea | 0:1.8.10-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-server-migration | <0:1.3.1-13.Final_redhat_00014.1.el7ea | 0:1.3.1-13.Final_redhat_00014.1.el7ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.6-4.SP3_redhat_00001.1.el7ea | 0:3.7.6-4.SP3_redhat_00001.1.el7ea |
| redhat/eap7-resteasy | <0:3.6.1-10.SP9_redhat_00001.1.el7ea | 0:3.6.1-10.SP9_redhat_00001.1.el7ea |
| redhat/eap7-undertow | <0:2.0.30-4.SP4_redhat_00001.1.el7ea | 0:2.0.30-4.SP4_redhat_00001.1.el7ea |
| redhat/eap7-weld-core | <0:3.0.6-4.Final_redhat_00004.1.el7ea | 0:3.0.6-4.Final_redhat_00004.1.el7ea |
| redhat/eap7-wildfly | <0:7.2.9-4.GA_redhat_00003.1.el7ea | 0:7.2.9-4.GA_redhat_00003.1.el7ea |
| redhat/eap7-wildfly-elytron | <0:1.6.8-1.Final_redhat_00001.1.el7ea | 0:1.6.8-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-wildfly-http-client | <0:1.0.22-1.Final_redhat_00001.1.el7ea | 0:1.0.22-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-wildfly-transaction-client | <0:1.1.11-1.Final_redhat_00001.1.el7ea | 0:1.1.11-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-dom4j | <0:2.1.3-1.redhat_00001.1.el8ea | 0:2.1.3-1.redhat_00001.1.el8ea |
| redhat/eap7-elytron-web | <0:1.2.5-1.Final_redhat_00001.1.el8ea | 0:1.2.5-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-glassfish-jsf | <0:2.3.5-13.SP3_redhat_00011.1.el8ea | 0:2.3.5-13.SP3_redhat_00011.1.el8ea |
| redhat/eap7-hal-console | <0:3.0.23-1.Final_redhat_00001.1.el8ea | 0:3.0.23-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-hibernate | <0:5.3.17-1.Final_redhat_00001.1.el8ea | 0:5.3.17-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-hibernate-validator | <0:6.0.20-1.Final_redhat_00001.1.el8ea | 0:6.0.20-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-ironjacamar | <0:1.4.22-1.Final_redhat_00001.1.el8ea | 0:1.4.22-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jackson-databind | <0:2.9.10.4-1.redhat_00001.1.el8ea | 0:2.9.10.4-1.redhat_00001.1.el8ea |
| redhat/eap7-jboss-genericjms | <0:2.0.6-1.Final_redhat_00001.1.el8ea | 0:2.0.6-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-logmanager | <0:2.1.15-1.Final_redhat_00001.1.el8ea | 0:2.1.15-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-modules | <0:1.8.10-1.Final_redhat_00001.1.el8ea | 0:1.8.10-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-server-migration | <0:1.3.1-13.Final_redhat_00014.1.el8ea | 0:1.3.1-13.Final_redhat_00014.1.el8ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.6-4.SP3_redhat_00001.1.el8ea | 0:3.7.6-4.SP3_redhat_00001.1.el8ea |
| redhat/eap7-resteasy | <0:3.6.1-10.SP9_redhat_00001.1.el8ea | 0:3.6.1-10.SP9_redhat_00001.1.el8ea |
| redhat/eap7-undertow | <0:2.0.30-4.SP4_redhat_00001.1.el8ea | 0:2.0.30-4.SP4_redhat_00001.1.el8ea |
| redhat/eap7-weld-core | <0:3.0.6-4.Final_redhat_00004.1.el8ea | 0:3.0.6-4.Final_redhat_00004.1.el8ea |
| redhat/eap7-wildfly | <0:7.2.9-4.GA_redhat_00003.1.el8ea | 0:7.2.9-4.GA_redhat_00003.1.el8ea |
| redhat/eap7-wildfly-elytron | <0:1.6.8-1.Final_redhat_00001.1.el8ea | 0:1.6.8-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-wildfly-http-client | <0:1.0.22-1.Final_redhat_00001.1.el8ea | 0:1.0.22-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-wildfly-transaction-client | <0:1.1.11-1.Final_redhat_00001.1.el8ea | 0:1.1.11-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-elytron-web | <0:1.6.2-1.Final_redhat_00001.1.el6ea | 0:1.6.2-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-glassfish-jsf | <0:2.3.9-11.SP11_redhat_00001.1.el6ea | 0:2.3.9-11.SP11_redhat_00001.1.el6ea |
| redhat/eap7-hal-console | <0:3.2.9-1.Final_redhat_00001.1.el6ea | 0:3.2.9-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-infinispan | <0:9.4.19-1.Final_redhat_00001.1.el6ea | 0:9.4.19-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jackson-annotations | <0:2.10.4-1.redhat_00001.1.el6ea | 0:2.10.4-1.redhat_00001.1.el6ea |
| redhat/eap7-jackson-core | <0:2.10.4-1.redhat_00001.1.el6ea | 0:2.10.4-1.redhat_00001.1.el6ea |
| redhat/eap7-jackson-databind | <0:2.10.4-1.redhat_00001.1.el6ea | 0:2.10.4-1.redhat_00001.1.el6ea |
| redhat/eap7-jackson-jaxrs-providers | <0:2.10.4-1.redhat_00001.1.el6ea | 0:2.10.4-1.redhat_00001.1.el6ea |
| redhat/eap7-jackson-modules-base | <0:2.10.4-1.redhat_00001.1.el6ea | 0:2.10.4-1.redhat_00001.1.el6ea |
| redhat/eap7-jackson-modules-java8 | <0:2.10.4-1.redhat_00001.1.el6ea | 0:2.10.4-1.redhat_00001.1.el6ea |
| redhat/eap7-jboss-server-migration | <0:1.7.1-7.Final_redhat_00009.1.el6ea | 0:1.7.1-7.Final_redhat_00009.1.el6ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.8-1.SP1_redhat_00001.1.el6ea | 0:3.7.8-1.SP1_redhat_00001.1.el6ea |
| redhat/eap7-netty | <0:4.1.48-1.Final_redhat_00001.1.el6ea | 0:4.1.48-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-wildfly | <0:7.3.2-4.GA_redhat_00002.1.el6ea | 0:7.3.2-4.GA_redhat_00002.1.el6ea |
| redhat/eap7-wildfly-common | <0:1.5.2-1.Final_redhat_00002.1.el6ea | 0:1.5.2-1.Final_redhat_00002.1.el6ea |
| redhat/eap7-wildfly-elytron | <0:1.10.7-1.Final_redhat_00001.1.el6ea | 0:1.10.7-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-elytron-web | <0:1.6.2-1.Final_redhat_00001.1.el7ea | 0:1.6.2-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-glassfish-jsf | <0:2.3.9-11.SP11_redhat_00001.1.el7ea | 0:2.3.9-11.SP11_redhat_00001.1.el7ea |
| redhat/eap7-hal-console | <0:3.2.9-1.Final_redhat_00001.1.el7ea | 0:3.2.9-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-infinispan | <0:9.4.19-1.Final_redhat_00001.1.el7ea | 0:9.4.19-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jackson-annotations | <0:2.10.4-1.redhat_00001.1.el7ea | 0:2.10.4-1.redhat_00001.1.el7ea |
| redhat/eap7-jackson-core | <0:2.10.4-1.redhat_00001.1.el7ea | 0:2.10.4-1.redhat_00001.1.el7ea |
| redhat/eap7-jackson-databind | <0:2.10.4-1.redhat_00001.1.el7ea | 0:2.10.4-1.redhat_00001.1.el7ea |
| redhat/eap7-jackson-jaxrs-providers | <0:2.10.4-1.redhat_00001.1.el7ea | 0:2.10.4-1.redhat_00001.1.el7ea |
| redhat/eap7-jackson-modules-base | <0:2.10.4-1.redhat_00001.1.el7ea | 0:2.10.4-1.redhat_00001.1.el7ea |
| redhat/eap7-jackson-modules-java8 | <0:2.10.4-1.redhat_00001.1.el7ea | 0:2.10.4-1.redhat_00001.1.el7ea |
| redhat/eap7-jboss-server-migration | <0:1.7.1-7.Final_redhat_00009.1.el7ea | 0:1.7.1-7.Final_redhat_00009.1.el7ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.8-1.SP1_redhat_00001.1.el7ea | 0:3.7.8-1.SP1_redhat_00001.1.el7ea |
| redhat/eap7-netty | <0:4.1.48-1.Final_redhat_00001.1.el7ea | 0:4.1.48-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-wildfly | <0:7.3.2-4.GA_redhat_00002.1.el7ea | 0:7.3.2-4.GA_redhat_00002.1.el7ea |
| redhat/eap7-wildfly-common | <0:1.5.2-1.Final_redhat_00002.1.el7ea | 0:1.5.2-1.Final_redhat_00002.1.el7ea |
| redhat/eap7-wildfly-elytron | <0:1.10.7-1.Final_redhat_00001.1.el7ea | 0:1.10.7-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-elytron-web | <0:1.6.2-1.Final_redhat_00001.1.el8ea | 0:1.6.2-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-glassfish-jsf | <0:2.3.9-11.SP11_redhat_00001.1.el8ea | 0:2.3.9-11.SP11_redhat_00001.1.el8ea |
| redhat/eap7-hal-console | <0:3.2.9-1.Final_redhat_00001.1.el8ea | 0:3.2.9-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-infinispan | <0:9.4.19-1.Final_redhat_00001.1.el8ea | 0:9.4.19-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jackson-annotations | <0:2.10.4-1.redhat_00001.1.el8ea | 0:2.10.4-1.redhat_00001.1.el8ea |
| redhat/eap7-jackson-core | <0:2.10.4-1.redhat_00001.1.el8ea | 0:2.10.4-1.redhat_00001.1.el8ea |
| redhat/eap7-jackson-databind | <0:2.10.4-1.redhat_00001.1.el8ea | 0:2.10.4-1.redhat_00001.1.el8ea |
| redhat/eap7-jackson-jaxrs-providers | <0:2.10.4-1.redhat_00001.1.el8ea | 0:2.10.4-1.redhat_00001.1.el8ea |
| redhat/eap7-jackson-modules-base | <0:2.10.4-1.redhat_00001.1.el8ea | 0:2.10.4-1.redhat_00001.1.el8ea |
| redhat/eap7-jackson-modules-java8 | <0:2.10.4-1.redhat_00001.1.el8ea | 0:2.10.4-1.redhat_00001.1.el8ea |
| redhat/eap7-jboss-server-migration | <0:1.7.1-7.Final_redhat_00009.1.el8ea | 0:1.7.1-7.Final_redhat_00009.1.el8ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.8-1.SP1_redhat_00001.1.el8ea | 0:3.7.8-1.SP1_redhat_00001.1.el8ea |
| redhat/eap7-netty | <0:4.1.48-1.Final_redhat_00001.1.el8ea | 0:4.1.48-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-wildfly | <0:7.3.2-4.GA_redhat_00002.1.el8ea | 0:7.3.2-4.GA_redhat_00002.1.el8ea |
| redhat/eap7-wildfly-common | <0:1.5.2-1.Final_redhat_00002.1.el8ea | 0:1.5.2-1.Final_redhat_00002.1.el8ea |
| redhat/eap7-wildfly-elytron | <0:1.10.7-1.Final_redhat_00001.1.el8ea | 0:1.10.7-1.Final_redhat_00001.1.el8ea |
| redhat/wildfly-elytron | <1.10.7. | 1.10.7. |
| Red Hat WildFly Elytron | <1.11.3 | |
| Red Hat CodeReady Studio | =12.0 | |
| Red Hat Decision Manager | =7.0 | |
| Red Hat JBoss Fuse | =7.0.0 | |
| Red Hat Process Automation Manager | =7.0 | |
| NetApp OnCommand Insight |
Remedy
This attack is dependent on the attacker being able to create a session and the victim accessing the session before the session expires, we do have a 15 minute session timeout by default but the attacker could also keep this alive by say sending in a request every five minutes. The server by default supports session tracking by URL and Cookie, if the web.xml is updated to support COOKIE only the exploit is not possible by sharing the link. ~~~ <session-config> <tracking-mode>URL</tracking-mode> </session-config> ~~~ TO ~~~ <session-config> <tracking-mode>COOKIE</tracking-mode> </session-config> ~~~
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1825714
- https://security.netapp.com/advisory/ntap-20201223-0002/
- https://issues.redhat.com/browse/ELY-1950
- https://owasp.org/www-community/attacks/Session_fixation
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1827511
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1827509
- https://access.redhat.com/errata/RHSA-2020:3464
- https://access.redhat.com/errata/RHSA-2020:3461
- https://access.redhat.com/errata/RHSA-2020:3462
- https://access.redhat.com/errata/RHSA-2020:3463
- https://access.redhat.com/security/cve/cve-2020-10714
- https://access.redhat.com/errata/RHSA-2020:3501
- https://access.redhat.com/errata/RHSA-2020:3585
- https://access.redhat.com/errata/RHSA-2020:3539
- https://access.redhat.com/errata/RHSA-2020:3637
- https://access.redhat.com/errata/RHSA-2020:3639
- https://access.redhat.com/errata/RHSA-2020:3638
- https://access.redhat.com/errata/RHSA-2020:3642
- https://access.redhat.com/errata/RHSA-2020:3779
- https://access.redhat.com/errata/RHSA-2020:4960
- https://access.redhat.com/errata/RHSA-2020:4961
- https://access.redhat.com/errata/RHSA-2021:3140
- https://www.cve.org/CVERecord?id=CVE-2020-10714 https://nvd.nist.gov/vuln/detail/CVE-2020-10714
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2020-10714?
CVE-2020-10714 has a high severity rating due to the potential for session fixation attacks affecting data confidentiality and integrity.
How do I fix CVE-2020-10714?
To fix CVE-2020-10714, upgrade to a fixed version of WildFly Elytron at or above 1.11.3.Final.
Which versions of WildFly Elytron are affected by CVE-2020-10714?
CVE-2020-10714 affects WildFly Elytron version 1.11.3.Final and earlier.
What is a session fixation attack in the context of CVE-2020-10714?
A session fixation attack allows an attacker to hijack a user's session by exploiting the session ID provided in the URL.
What platforms are affected by CVE-2020-10714?
CVE-2020-10714 affects various Red Hat JBoss EAP packages, especially versions dependent on the vulnerable WildFly Elytron implementation.
- collector/redhat-cve
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/author
- agent/severity
- agent/references
- agent/remedy
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-10714
- agent/software-canonical-lookup
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/redhat
- canonical/red hat wildfly elytron
- canonical/red hat codeready studio
- version/red hat codeready studio/12.0
- canonical/red hat decision manager
- version/red hat decision manager/7.0
- canonical/red hat jboss fuse
- version/red hat jboss fuse/7.0.0
- canonical/red hat process automation manager
- version/red hat process automation manager/7.0
- vendor/netapp
- canonical/netapp oncommand insight