Vulnerability/
CVE-2020-10740

7.5

CWE

502 20

11/5/2020

2/6/2020

24/5/2022

22/8/2023

CVE-2020-10740: Input Validation

First published: Mon May 11 2020(Updated: )

A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.

Credit: secalert@redhat.com

Affected Software	Affected Version	How to fix
maven/org.wildfly:wildfly-parent	<20.0.0.Final	20.0.0.Final
redhat/eap7-jboss-ejb-client	<0:4.0.33-2.SP1_redhat_00001.1.el6ea	0:4.0.33-2.SP1_redhat_00001.1.el6ea
redhat/eap7-wildfly	<0:7.2.8-6.GA_redhat_00003.1.el6ea	0:7.2.8-6.GA_redhat_00003.1.el6ea
redhat/eap7-wildfly-http-client	<0:1.0.21-1.Final_redhat_00001.1.el6ea	0:1.0.21-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-naming-client	<0:1.0.13-1.Final_redhat_00001.1.el6ea	0:1.0.13-1.Final_redhat_00001.1.el6ea
redhat/eap7-dom4j	<0:2.1.3-1.redhat_00001.1.el6ea	0:2.1.3-1.redhat_00001.1.el6ea
redhat/eap7-elytron-web	<0:1.2.5-1.Final_redhat_00001.1.el6ea	0:1.2.5-1.Final_redhat_00001.1.el6ea
redhat/eap7-glassfish-jsf	<0:2.3.5-13.SP3_redhat_00011.1.el6ea	0:2.3.5-13.SP3_redhat_00011.1.el6ea
redhat/eap7-hal-console	<0:3.0.23-1.Final_redhat_00001.1.el6ea	0:3.0.23-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate	<0:5.3.17-1.Final_redhat_00001.1.el6ea	0:5.3.17-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate-validator	<0:6.0.20-1.Final_redhat_00001.1.el6ea	0:6.0.20-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar	<0:1.4.22-1.Final_redhat_00001.1.el6ea	0:1.4.22-1.Final_redhat_00001.1.el6ea
redhat/eap7-jackson-databind	<0:2.9.10.4-1.redhat_00001.1.el6ea	0:2.9.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jboss-genericjms	<0:2.0.6-1.Final_redhat_00001.1.el6ea	0:2.0.6-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-logmanager	<0:2.1.15-1.Final_redhat_00001.1.el6ea	0:2.1.15-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-modules	<0:1.8.10-1.Final_redhat_00001.1.el6ea	0:1.8.10-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration	<0:1.3.1-13.Final_redhat_00014.1.el6ea	0:1.3.1-13.Final_redhat_00014.1.el6ea
redhat/eap7-jboss-xnio-base	<0:3.7.6-4.SP3_redhat_00001.1.el6ea	0:3.7.6-4.SP3_redhat_00001.1.el6ea
redhat/eap7-resteasy	<0:3.6.1-10.SP9_redhat_00001.1.el6ea	0:3.6.1-10.SP9_redhat_00001.1.el6ea
redhat/eap7-undertow	<0:2.0.30-4.SP4_redhat_00001.1.el6ea	0:2.0.30-4.SP4_redhat_00001.1.el6ea
redhat/eap7-weld-core	<0:3.0.6-4.Final_redhat_00004.1.el6ea	0:3.0.6-4.Final_redhat_00004.1.el6ea
redhat/eap7-wildfly	<0:7.2.9-4.GA_redhat_00003.1.el6ea	0:7.2.9-4.GA_redhat_00003.1.el6ea
redhat/eap7-wildfly-elytron	<0:1.6.8-1.Final_redhat_00001.1.el6ea	0:1.6.8-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-http-client	<0:1.0.22-1.Final_redhat_00001.1.el6ea	0:1.0.22-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-transaction-client	<0:1.1.11-1.Final_redhat_00001.1.el6ea	0:1.1.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-ejb-client	<0:4.0.33-2.SP1_redhat_00001.1.el7ea	0:4.0.33-2.SP1_redhat_00001.1.el7ea
redhat/eap7-wildfly	<0:7.2.8-6.GA_redhat_00003.1.el7ea	0:7.2.8-6.GA_redhat_00003.1.el7ea
redhat/eap7-wildfly-http-client	<0:1.0.21-1.Final_redhat_00001.1.el7ea	0:1.0.21-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-naming-client	<0:1.0.13-1.Final_redhat_00001.1.el7ea	0:1.0.13-1.Final_redhat_00001.1.el7ea
redhat/eap7-dom4j	<0:2.1.3-1.redhat_00001.1.el7ea	0:2.1.3-1.redhat_00001.1.el7ea
redhat/eap7-elytron-web	<0:1.2.5-1.Final_redhat_00001.1.el7ea	0:1.2.5-1.Final_redhat_00001.1.el7ea
redhat/eap7-glassfish-jsf	<0:2.3.5-13.SP3_redhat_00011.1.el7ea	0:2.3.5-13.SP3_redhat_00011.1.el7ea
redhat/eap7-hal-console	<0:3.0.23-1.Final_redhat_00001.1.el7ea	0:3.0.23-1.Final_redhat_00001.1.el7ea
redhat/eap7-hibernate	<0:5.3.17-1.Final_redhat_00001.1.el7ea	0:5.3.17-1.Final_redhat_00001.1.el7ea
redhat/eap7-hibernate-validator	<0:6.0.20-1.Final_redhat_00001.1.el7ea	0:6.0.20-1.Final_redhat_00001.1.el7ea
redhat/eap7-ironjacamar	<0:1.4.22-1.Final_redhat_00001.1.el7ea	0:1.4.22-1.Final_redhat_00001.1.el7ea
redhat/eap7-jackson-databind	<0:2.9.10.4-1.redhat_00001.1.el7ea	0:2.9.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jboss-genericjms	<0:2.0.6-1.Final_redhat_00001.1.el7ea	0:2.0.6-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-logmanager	<0:2.1.15-1.Final_redhat_00001.1.el7ea	0:2.1.15-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-modules	<0:1.8.10-1.Final_redhat_00001.1.el7ea	0:1.8.10-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration	<0:1.3.1-13.Final_redhat_00014.1.el7ea	0:1.3.1-13.Final_redhat_00014.1.el7ea
redhat/eap7-jboss-xnio-base	<0:3.7.6-4.SP3_redhat_00001.1.el7ea	0:3.7.6-4.SP3_redhat_00001.1.el7ea
redhat/eap7-resteasy	<0:3.6.1-10.SP9_redhat_00001.1.el7ea	0:3.6.1-10.SP9_redhat_00001.1.el7ea
redhat/eap7-undertow	<0:2.0.30-4.SP4_redhat_00001.1.el7ea	0:2.0.30-4.SP4_redhat_00001.1.el7ea
redhat/eap7-weld-core	<0:3.0.6-4.Final_redhat_00004.1.el7ea	0:3.0.6-4.Final_redhat_00004.1.el7ea
redhat/eap7-wildfly	<0:7.2.9-4.GA_redhat_00003.1.el7ea	0:7.2.9-4.GA_redhat_00003.1.el7ea
redhat/eap7-wildfly-elytron	<0:1.6.8-1.Final_redhat_00001.1.el7ea	0:1.6.8-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-http-client	<0:1.0.22-1.Final_redhat_00001.1.el7ea	0:1.0.22-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-transaction-client	<0:1.1.11-1.Final_redhat_00001.1.el7ea	0:1.1.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-ejb-client	<0:4.0.33-2.SP1_redhat_00001.1.el8ea	0:4.0.33-2.SP1_redhat_00001.1.el8ea
redhat/eap7-wildfly	<0:7.2.8-6.GA_redhat_00003.1.el8ea	0:7.2.8-6.GA_redhat_00003.1.el8ea
redhat/eap7-wildfly-http-client	<0:1.0.21-1.Final_redhat_00001.1.el8ea	0:1.0.21-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-naming-client	<0:1.0.13-1.Final_redhat_00001.1.el8ea	0:1.0.13-1.Final_redhat_00001.1.el8ea
redhat/eap7-dom4j	<0:2.1.3-1.redhat_00001.1.el8ea	0:2.1.3-1.redhat_00001.1.el8ea
redhat/eap7-elytron-web	<0:1.2.5-1.Final_redhat_00001.1.el8ea	0:1.2.5-1.Final_redhat_00001.1.el8ea
redhat/eap7-glassfish-jsf	<0:2.3.5-13.SP3_redhat_00011.1.el8ea	0:2.3.5-13.SP3_redhat_00011.1.el8ea
redhat/eap7-hal-console	<0:3.0.23-1.Final_redhat_00001.1.el8ea	0:3.0.23-1.Final_redhat_00001.1.el8ea
redhat/eap7-hibernate	<0:5.3.17-1.Final_redhat_00001.1.el8ea	0:5.3.17-1.Final_redhat_00001.1.el8ea
redhat/eap7-hibernate-validator	<0:6.0.20-1.Final_redhat_00001.1.el8ea	0:6.0.20-1.Final_redhat_00001.1.el8ea
redhat/eap7-ironjacamar	<0:1.4.22-1.Final_redhat_00001.1.el8ea	0:1.4.22-1.Final_redhat_00001.1.el8ea
redhat/eap7-jackson-databind	<0:2.9.10.4-1.redhat_00001.1.el8ea	0:2.9.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jboss-genericjms	<0:2.0.6-1.Final_redhat_00001.1.el8ea	0:2.0.6-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-logmanager	<0:2.1.15-1.Final_redhat_00001.1.el8ea	0:2.1.15-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-modules	<0:1.8.10-1.Final_redhat_00001.1.el8ea	0:1.8.10-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration	<0:1.3.1-13.Final_redhat_00014.1.el8ea	0:1.3.1-13.Final_redhat_00014.1.el8ea
redhat/eap7-jboss-xnio-base	<0:3.7.6-4.SP3_redhat_00001.1.el8ea	0:3.7.6-4.SP3_redhat_00001.1.el8ea
redhat/eap7-resteasy	<0:3.6.1-10.SP9_redhat_00001.1.el8ea	0:3.6.1-10.SP9_redhat_00001.1.el8ea
redhat/eap7-undertow	<0:2.0.30-4.SP4_redhat_00001.1.el8ea	0:2.0.30-4.SP4_redhat_00001.1.el8ea
redhat/eap7-weld-core	<0:3.0.6-4.Final_redhat_00004.1.el8ea	0:3.0.6-4.Final_redhat_00004.1.el8ea
redhat/eap7-wildfly	<0:7.2.9-4.GA_redhat_00003.1.el8ea	0:7.2.9-4.GA_redhat_00003.1.el8ea
redhat/eap7-wildfly-elytron	<0:1.6.8-1.Final_redhat_00001.1.el8ea	0:1.6.8-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-http-client	<0:1.0.22-1.Final_redhat_00001.1.el8ea	0:1.0.22-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-transaction-client	<0:1.1.11-1.Final_redhat_00001.1.el8ea	0:1.1.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly	<0:7.3.1-7.GA_redhat_00004.1.el6ea	0:7.3.1-7.GA_redhat_00004.1.el6ea
redhat/eap7-elytron-web	<0:1.6.2-1.Final_redhat_00001.1.el6ea	0:1.6.2-1.Final_redhat_00001.1.el6ea
redhat/eap7-glassfish-jsf	<0:2.3.9-11.SP11_redhat_00001.1.el6ea	0:2.3.9-11.SP11_redhat_00001.1.el6ea
redhat/eap7-hal-console	<0:3.2.9-1.Final_redhat_00001.1.el6ea	0:3.2.9-1.Final_redhat_00001.1.el6ea
redhat/eap7-infinispan	<0:9.4.19-1.Final_redhat_00001.1.el6ea	0:9.4.19-1.Final_redhat_00001.1.el6ea
redhat/eap7-jackson-annotations	<0:2.10.4-1.redhat_00001.1.el6ea	0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jackson-core	<0:2.10.4-1.redhat_00001.1.el6ea	0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jackson-databind	<0:2.10.4-1.redhat_00001.1.el6ea	0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jackson-jaxrs-providers	<0:2.10.4-1.redhat_00001.1.el6ea	0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jackson-modules-base	<0:2.10.4-1.redhat_00001.1.el6ea	0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jackson-modules-java8	<0:2.10.4-1.redhat_00001.1.el6ea	0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration	<0:1.7.1-7.Final_redhat_00009.1.el6ea	0:1.7.1-7.Final_redhat_00009.1.el6ea
redhat/eap7-jboss-xnio-base	<0:3.7.8-1.SP1_redhat_00001.1.el6ea	0:3.7.8-1.SP1_redhat_00001.1.el6ea
redhat/eap7-netty	<0:4.1.48-1.Final_redhat_00001.1.el6ea	0:4.1.48-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly	<0:7.3.2-4.GA_redhat_00002.1.el6ea	0:7.3.2-4.GA_redhat_00002.1.el6ea
redhat/eap7-wildfly-common	<0:1.5.2-1.Final_redhat_00002.1.el6ea	0:1.5.2-1.Final_redhat_00002.1.el6ea
redhat/eap7-wildfly-elytron	<0:1.10.7-1.Final_redhat_00001.1.el6ea	0:1.10.7-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly	<0:7.3.1-7.GA_redhat_00004.1.el7ea	0:7.3.1-7.GA_redhat_00004.1.el7ea
redhat/eap7-elytron-web	<0:1.6.2-1.Final_redhat_00001.1.el7ea	0:1.6.2-1.Final_redhat_00001.1.el7ea
redhat/eap7-glassfish-jsf	<0:2.3.9-11.SP11_redhat_00001.1.el7ea	0:2.3.9-11.SP11_redhat_00001.1.el7ea
redhat/eap7-hal-console	<0:3.2.9-1.Final_redhat_00001.1.el7ea	0:3.2.9-1.Final_redhat_00001.1.el7ea
redhat/eap7-infinispan	<0:9.4.19-1.Final_redhat_00001.1.el7ea	0:9.4.19-1.Final_redhat_00001.1.el7ea
redhat/eap7-jackson-annotations	<0:2.10.4-1.redhat_00001.1.el7ea	0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jackson-core	<0:2.10.4-1.redhat_00001.1.el7ea	0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jackson-databind	<0:2.10.4-1.redhat_00001.1.el7ea	0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jackson-jaxrs-providers	<0:2.10.4-1.redhat_00001.1.el7ea	0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jackson-modules-base	<0:2.10.4-1.redhat_00001.1.el7ea	0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jackson-modules-java8	<0:2.10.4-1.redhat_00001.1.el7ea	0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration	<0:1.7.1-7.Final_redhat_00009.1.el7ea	0:1.7.1-7.Final_redhat_00009.1.el7ea
redhat/eap7-jboss-xnio-base	<0:3.7.8-1.SP1_redhat_00001.1.el7ea	0:3.7.8-1.SP1_redhat_00001.1.el7ea
redhat/eap7-netty	<0:4.1.48-1.Final_redhat_00001.1.el7ea	0:4.1.48-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly	<0:7.3.2-4.GA_redhat_00002.1.el7ea	0:7.3.2-4.GA_redhat_00002.1.el7ea
redhat/eap7-wildfly-common	<0:1.5.2-1.Final_redhat_00002.1.el7ea	0:1.5.2-1.Final_redhat_00002.1.el7ea
redhat/eap7-wildfly-elytron	<0:1.10.7-1.Final_redhat_00001.1.el7ea	0:1.10.7-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly	<0:7.3.1-7.GA_redhat_00004.1.el8	0:7.3.1-7.GA_redhat_00004.1.el8
redhat/eap7-elytron-web	<0:1.6.2-1.Final_redhat_00001.1.el8ea	0:1.6.2-1.Final_redhat_00001.1.el8ea
redhat/eap7-glassfish-jsf	<0:2.3.9-11.SP11_redhat_00001.1.el8ea	0:2.3.9-11.SP11_redhat_00001.1.el8ea
redhat/eap7-hal-console	<0:3.2.9-1.Final_redhat_00001.1.el8ea	0:3.2.9-1.Final_redhat_00001.1.el8ea
redhat/eap7-infinispan	<0:9.4.19-1.Final_redhat_00001.1.el8ea	0:9.4.19-1.Final_redhat_00001.1.el8ea
redhat/eap7-jackson-annotations	<0:2.10.4-1.redhat_00001.1.el8ea	0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jackson-core	<0:2.10.4-1.redhat_00001.1.el8ea	0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jackson-databind	<0:2.10.4-1.redhat_00001.1.el8ea	0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jackson-jaxrs-providers	<0:2.10.4-1.redhat_00001.1.el8ea	0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jackson-modules-base	<0:2.10.4-1.redhat_00001.1.el8ea	0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jackson-modules-java8	<0:2.10.4-1.redhat_00001.1.el8ea	0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration	<0:1.7.1-7.Final_redhat_00009.1.el8ea	0:1.7.1-7.Final_redhat_00009.1.el8ea
redhat/eap7-jboss-xnio-base	<0:3.7.8-1.SP1_redhat_00001.1.el8ea	0:3.7.8-1.SP1_redhat_00001.1.el8ea
redhat/eap7-netty	<0:4.1.48-1.Final_redhat_00001.1.el8ea	0:4.1.48-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly	<0:7.3.2-4.GA_redhat_00002.1.el8ea	0:7.3.2-4.GA_redhat_00002.1.el8ea
redhat/eap7-wildfly-common	<0:1.5.2-1.Final_redhat_00002.1.el8ea	0:1.5.2-1.Final_redhat_00002.1.el8ea
redhat/eap7-wildfly-elytron	<0:1.10.7-1.Final_redhat_00001.1.el8ea	0:1.10.7-1.Final_redhat_00001.1.el8ea
redhat/Wildfly	<20.0.0.	20.0.0.
Red Hat JBoss WildFly Application Server	<20.0.0

Remedy

There is currently no known mitigation for this issue.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read More Start Free Trial

Example email

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

What is the severity of CVE-2020-10740?
CVE-2020-10740 has been assigned a medium severity rating due to its potential for remote exploitation via deserialization attacks.
How do I fix CVE-2020-10740?
To fix CVE-2020-10740, upgrade Wildfly to version 20.0.0.Final or later.
What systems are affected by CVE-2020-10740?
CVE-2020-10740 affects Wildfly versions prior to 20.0.0.Final.
What type of vulnerability is CVE-2020-10740?
CVE-2020-10740 is a remote deserialization vulnerability specifically related to Enterprise Application Beans in Wildfly.
Can CVE-2020-10740 be exploited remotely?
Yes, CVE-2020-10740 can be exploited remotely due to its nature as a remote deserialization attack.

collector/github-advisory-latest
alias/GHSA-vrmw-2xhq-hrmp
alias/CVE-2020-10740
collector/github-advisory
collector/redhat-cve
agent/type
agent/last-modified-date
agent/first-publish-date
agent/severity
agent/references
agent/remedy
agent/weakness
agent/description
collector/redhat-bugzilla
source/Red Hat
agent/software-canonical-lookup
agent/event
agent/trending
agent/source
agent/tags
agent/softwarecombine
collector/nvd-cve
agent/software-canonical-lookup-request
collector/nvd-index
agent/author
package-manager/maven
package-manager/redhat
vendor/redhat
canonical/red hat jboss wildfly application server

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203