Read the docs
TI-2020-01663 Aliases CVE-2020-1719GHSA-p9cf-qjxq-vxw6

A flaw was found in wildfly.

Priority LOW 25CWE-270Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 13 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.

Why it matters now

EPSS 0.00575 47th percentileScored 2026-11-07
Fix Partial org.wildfly.bom:wildfly (Maven): 20.0.0.FinalRed Hat: 13 advisoriesRed Hat: 13 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Wildflywildfly 20.0.0.Final—No fix listedCNA
—org.wildfly.bom:wildfly (Maven)before 20.0.0.Final20.0.0.FinalPatch availableGHSA-p9cf-qjxq-vxw6
  • Wildfly Vendor— Affected wildfly 20.0.0.Final Fixed in — No fix listed CNA
  • org.wildfly.bom:wildfly (Maven) Vendor— Affected before 20.0.0.Final Fixed in 20.0.0.Final Patch available GHSA-p9cf-qjxq-vxw6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*before 20.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* Versions before 20.0.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-p9cf-qjxq-vxw6 org.wildfly.bom:wildfly (Maven) Fixed in 20.0.0.Final Advisory →

Red Hat 13 advisories

  • RHSA-2020:5568 Released 2020-12-16 · Red Hat rating Important
    Red Hat Fuse 7.8.0 release and security update
    • Red Hat Fuse 7.8.0
  • RHSA-2020:3779 Released 2020-09-17 · Red Hat rating Important
    Red Hat Data Grid 7.3.7 security update
    • Red Hat Data Grid 7.3.7
  • RHSA-2020:3585 Released 2020-08-31 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 20 security update
    • EAP-CD 20 Tech Preview
Show 10 more Red Hat advisories
  • RHSA-2020:2905 Released 2020-07-23 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.0 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:2511 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47
  • RHSA-2020:2512 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
  • RHSA-2020:2513 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
  • RHSA-2020:2515 Released 2020-06-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:2112 Released 2020-05-12 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.8 security update
    • Red Hat Single Sign On 7.3.8
  • RHSA-2020:2061 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2020:2060 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
  • RHSA-2020:2059 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
  • RHSA-2020:2058 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Out of support scope
EAP-CD 20 Tech PreviewFixed RHSA-2020:3585
Red Hat Data Grid 7.3.7Fixed RHSA-2020:3779
Red Hat Fuse 7.8.0Fixed RHSA-2020:5568
Red Hat JBoss EAP 7.2Fixed RHSA-2020:2061
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:2058
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:2059
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:2060
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:2513
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:2511
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:2512
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:2515
Red Hat Single Sign On 7.3.8Fixed RHSA-2020:2112
Text-Only RHOARFixed RHSA-2020:2905
Not affected: 2 products
  • Red Hat Decision Manager 7
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1719
  2. 2026-10-03 Alias added: GHSA-p9cf-qjxq-vxw6
  3. 2026-11-06 Fix available: Red Hat JBoss Enterprise Application Platform 7 · Red Hat

References

Advisory 2

  • TI-2018-07554 An issue was discovered in WildFly 10.1.2.Final. CVSS 3.1CRITICAL 9.8
  • TI-2019-11091 A flaw was found when an OpenSSL security provider is used with Wildfly, the… CVSS 3.1CRITICAL 9.1
  • TI-2019-02903 It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in… CVSS 3.1HIGH 8.8
  • TI-2020-08639 Deserialization of untrusted data in [UNKNOWN] wildfly CVSS 3.1HIGH 7.5
  • TI-2020-08617 A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded… CVSS 3.1HIGH 7.5
  • TI-2022-01162 A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and… CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences