Session fixation in wildfly-elytron
Priority LOW 36CWE-384Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 14 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-384.
Summary
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Why it matters now
EPSS 0.01454 73rd percentileScored 2026-11-07
Fix Partial org.wildfly.security:wildfly-elytron (Maven): 1.11.4Red Hat: 15 advisoriesRed Hat: 14 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | wildfly-elytron | wildfly-elytron 1.10.7.Final | — | No fix listed | CNA |
| — | org.wildfly.security:wildfly-elytron (Maven) | before 1.11.4 | 1.11.4 | Patch available | GHSA-7fhr-2694-rg79 |
- wildfly-elytron Vendor— Affected wildfly-elytron 1.10.7.Final Fixed in — No fix listed CNA
- org.wildfly.security:wildfly-elytron (Maven) Vendor— Affected before 1.11.4 Fixed in 1.11.4 Patch available GHSA-7fhr-2694-rg79
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:wildfly_elytron:*:*:*:*:*:*:*:* | before 1.11.3 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_studio:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:redhat:wildfly_elytron:*:*:*:*:*:*:*:* Versions before 1.11.3 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_studio:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-7fhr-2694-rg79 org.wildfly.security:wildfly-elytron (Maven) Fixed in 1.11.4 Advisory →
Red Hat 15 advisories
- RHSA-2021:3140 Released 2021-08-11 · Red Hat rating ModerateRed Hat Fuse 7.9.0 release and security update
- Red Hat Fuse 7.9
- RHSA-2020:4961 Released 2020-11-05 · Red Hat rating ModerateRed Hat Process Automation Manager 7.9.0 security update
- RHPAM 7.9.0
- RHSA-2020:4960 Released 2020-11-05 · Red Hat rating ModerateRed Hat Decision Manager 7.9.0 security update
- RHDM 7.9.0
Show 12 more Red Hat advisories
- RHSA-2020:3779 Released 2020-09-17 · Red Hat rating ImportantRed Hat Data Grid 7.3.7 security update
- Red Hat Data Grid 7.3.7
- RHSA-2020:3642 Released 2020-09-07 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.9 security update
- Red Hat JBoss Enterprise Application Platform 7
- RHSA-2020:3638 Released 2020-09-07 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el7eap +47
- RHSA-2020:3639 Released 2020-09-07 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el8eap +47
- RHSA-2020:3637 Released 2020-09-07 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el6eap +47
- RHSA-2020:3539 Released 2020-09-02 · Red Hat rating ImportantRed Hat build of Thorntail 2.7.1 security and bug fix update
- Text-Only RHOAR
- RHSA-2020:3585 Released 2020-08-31 · Red Hat rating ImportantEAP Continuous Delivery Technical Preview Release 20 security update
- EAP-CD 20 Tech Preview
- RHSA-2020:3501 Released 2020-08-18 · Red Hat rating ImportantRed Hat Single Sign-On 7.4.2 security update
- Red Hat Single Sign-On 7.4.2
- RHSA-2020:3463 Released 2020-08-17 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.2 security update
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el8eap +47
- RHSA-2020:3462 Released 2020-08-17 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.2 security update
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el7eap +47
- RHSA-2020:3461 Released 2020-08-17 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.2 security update
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el6eap +47
- RHSA-2020:3464 Released 2020-08-17 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.2 security update
- Red Hat JBoss Enterprise Application Platform 7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| EAP-CD 20 Tech Preview | Fixed | RHSA-2020:3585 |
| RHDM 7.9.0 | Fixed | RHSA-2020:4960 |
| RHPAM 7.9.0 | Fixed | RHSA-2020:4961 |
| Red Hat Data Grid 7.3.7 | Fixed | RHSA-2020:3779 |
| Red Hat Fuse 7.9 | Fixed | RHSA-2021:3140 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2020:3637 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2020:3638 |
| Red Hat JBoss EAP 7.2 for RHEL 8 | Fixed | RHSA-2020:3639 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2020:3463 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2020:3461 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2020:3462 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2020:3464 |
| Red Hat Single Sign-On 7.4.2 | Fixed | RHSA-2020:3501 |
| Text-Only RHOAR | Fixed | RHSA-2020:3539 |
Not affected: 1 product
- Red Hat Data Grid 8
Timeline
- 2026-10-02 Threatist record created from CVE-2020-10714
- 2026-10-03 Alias added: GHSA-7fhr-2694-rg79
References
Sources
- CVE-2020-10714 · CVE Program
- CVE-2020-10714 · NVD
- FIRST EPSS
- GHSA-7fhr-2694-rg79 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-10714 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences