CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2020-10714
High (7.5). EPSS 1.5% chance of exploitation in the next 30 days. Fixed in org.wildfly.security:wildfly-elytron 1.11.4.
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- CWE
- CWE-384
- Published
- Modified
- Record from
- the NVD, synced
Affected
- netapp:oncommand_insight
- redhat:codeready_studio
- redhat:descision_manager
- redhat:jboss_fuse
- redhat:process_automation
- redhat:wildfly_elytron
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7fhr-2694-rg79 | Maven | org.wildfly.security:wildfly-elytron | <1.11.4 | 1.11.4 |