Read the docs
TI-2020-08617 Aliases CVE-2020-10718GHSA-wqwx-hvg4-2wh9

A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded…

Priority LOW 36Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 9 fixed, 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.

Why it matters now

EPSS 0.01435 73rd percentileScored 2026-11-07
Fix Partial Red Hat: 10 advisoriesRed Hat: 9 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Wildflybefore wildfly-embedded-13.0.0.Final—No fix listedCNA
  • Wildfly Vendor— Affected before wildfly-embedded-13.0.0.Final Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*before 13.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* Versions before 13.0.0 Vulnerable ·Red Hat

Remediation

Red Hat 10 advisories

  • RHSA-2020:3642 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:3638 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el7eap +47
  • RHSA-2020:3639 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el8eap +47
Show 7 more Red Hat advisories
  • RHSA-2020:3637 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el6eap +47
  • RHSA-2020:3539 Released 2020-09-02 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:3501 Released 2020-08-18 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.2 security update
    • Red Hat Single Sign-On 7.4.2
  • RHSA-2020:3463 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el8eap +47
  • RHSA-2020:3462 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el7eap +47
  • RHSA-2020:3461 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el6eap +47
  • RHSA-2020:3464 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss Enterprise Application Platform 7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Continuous DeliveryAffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:3637
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:3638
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:3639
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:3463
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:3461
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:3462
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:3464
Red Hat Single Sign-On 7.4.2Fixed RHSA-2020:3501
Text-Only RHOARFixed RHSA-2020:3539
Not affected: 4 products
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat JBoss Fuse 6
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10718
  2. 2026-10-03 Alias added: GHSA-wqwx-hvg4-2wh9

References

Advisory 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2015-06239 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data… CVSS 3.0CRITICAL 9.8
  • TI-2021-02983 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVSS 3.1HIGH 7.5
  • TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2019-07493 XML external entity injection in Red Hat jackson-mapper-asl CVSS 3.1HIGH 7.5
  • TI-2014-00115 The admin terminal in Hawt.io does not require authentication, which allows remote… CVSS 3.0CRITICAL 9.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences