Read the docs
TI-2020-11209 Aliases CVE-2020-14338GHSA-w4jq-qh47-hvjq

Improper input validation in Wildfly

Priority LOW 27CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 9 fixed, 12 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.

Why it matters now

EPSS 0.01292 70th percentileScored 2026-11-07
Fix Partial xerces:xercesImpl (Maven): 2.12.0.sp3Red Hat: 9 advisoriesRed Hat: 9 fixed, 12 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—WildflyAll xerces jboss versions before 2.12.0.SP3—No fix listedCNA
—xerces:xercesImpl (Maven)before 2.12.0.sp32.12.0.sp3Patch availableGHSA-w4jq-qh47-hvjq
  • Wildfly Vendor— Affected All xerces jboss versions before 2.12.0.SP3 Fixed in — No fix listed CNA
  • xerces:xercesImpl (Maven) Vendor— Affected before 2.12.0.sp3 Fixed in 2.12.0.sp3 Patch available GHSA-w4jq-qh47-hvjq

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redhat:xerces:*:*:*:*:*:*:*:*before 2.12.0VulnerableRed Hat
cpe:2.3:a:redhat:xerces:2.12.0:sp1:*:*:*:*:*:*2.12.0 sp1VulnerableRed Hat
cpe:2.3:a:redhat:xerces:2.12.0:sp2:*:*:*:*:*:*2.12.0 sp2VulnerableRed Hat
  • cpe:2.3:a:redhat:xerces:*:*:*:*:*:*:*:* Versions before 2.12.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:xerces:2.12.0:sp1:*:*:*:*:*:* Versions 2.12.0 sp1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:xerces:2.12.0:sp2:*:*:*:*:*:* Versions 2.12.0 sp2 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-w4jq-qh47-hvjq xerces:xercesImpl (Maven) Fixed in 2.12.0.sp3 Advisory →

Red Hat 9 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2021:0603 Released 2021-02-17 · Red Hat rating Important
    Red Hat Decision Manager 7.10.0 security update
    • RHDM 7.10.0
  • RHSA-2021:0600 Released 2021-02-17 · Red Hat rating Important
    Red Hat Process Automation Manager 7.10.0 security update
    • RHPAM 7.10.0
Show 6 more Red Hat advisories
  • RHSA-2020:5361 Released 2020-12-16 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.2 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:4931 Released 2020-11-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.3 security update
    • Red Hat Single Sign-On 7.4.3
  • RHSA-2020:4247 Released 2020-10-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.3 security update
    • EAP 7.3.3
  • RHSA-2020:4246 Released 2020-10-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 7
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-5.redhat_00011.1.el7eap, eap7-activemq-artemis-cli-2.9.0-5.redhat_00011.1.el7eap, eap7-activemq-artemis-commons-2.9.0-5.redhat_00011.1.el7eap +47
  • RHSA-2020:4245 Released 2020-10-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 8
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-5.redhat_00011.1.el8eap, eap7-activemq-artemis-cli-2.9.0-5.redhat_00011.1.el8eap, eap7-activemq-artemis-commons-2.9.0-5.redhat_00011.1.el8eap +47
  • RHSA-2020:4244 Released 2020-10-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 6
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-5.redhat_00011.1.el6eap, eap7-activemq-artemis-cli-2.9.0-5.redhat_00011.1.el6eap, eap7-activemq-artemis-commons-2.9.0-5.redhat_00011.1.el6eap +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Continuous DeliveryAffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
EAP 7.3.3Fixed RHSA-2020:4247
RHDM 7.10.0Fixed RHSA-2021:0603
RHPAM 7.10.0Fixed RHSA-2021:0600
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:4245
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:4244
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:4246
Red Hat Single Sign-On 7.4.3Fixed RHSA-2020:4931
Text-Only RHOARFixed RHSA-2020:5361
Not affected: 1 product
  • A-MQ Clients 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14338
  2. 2026-10-03 Alias added: GHSA-w4jq-qh47-hvjq

References

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences