Read the docs
TI-2020-15658 Aliases CVE-2020-25640GHSA-jw3v-5ch2-wfmm

Information disclosure through error messages in wildfly

Priority LOW 27CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 7 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-209.

Summary

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

Why it matters now

EPSS 0.01348 71st percentileScored 2026-11-07
Fix Partial org.wildfly:wildfly-parent (Maven): 21.0.0.FinalRed Hat: 7 advisoriesRed Hat: 7 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—wildflyWildfly 21.0.0.Final—No fix listedCNA
—org.wildfly:wildfly-parent (Maven)before 21.0.0.Final21.0.0.FinalPatch availableGHSA-jw3v-5ch2-wfmm
  • wildfly Vendor— Affected Wildfly 21.0.0.Final Fixed in — No fix listed CNA
  • org.wildfly:wildfly-parent (Maven) Vendor— Affected before 21.0.0.Final Fixed in 21.0.0.Final Patch available GHSA-jw3v-5ch2-wfmm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*before 21.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* Versions before 21.0.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-jw3v-5ch2-wfmm org.wildfly:wildfly-parent (Maven) Fixed in 21.0.0.Final Advisory →

Red Hat 7 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2021:0295 Released 2021-02-08 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.3 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2021:0327 Released 2021-02-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.5 security update
    • Red Hat Single Sign-On 7.4.5
Show 4 more Red Hat advisories
  • RHSA-2021:0248 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el8eap +47
  • RHSA-2021:0247 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el7eap +47
  • RHSA-2021:0246 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el6eap +47
  • RHSA-2021:0250 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss Enterprise Application Platform 7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:0248
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:0246
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:0247
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2021:0250
Red Hat Single Sign-On 7.4.5Fixed RHSA-2021:0327
Text-Only RHOARFixed RHSA-2021:0295
Not affected: 3 products
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25640
  2. 2026-10-03 Alias added: GHSA-jw3v-5ch2-wfmm

References

Advisory 4

Other 1

  • TI-2018-07554 An issue was discovered in WildFly 10.1.2.Final. CVSS 3.1CRITICAL 9.8
  • TI-2019-11091 A flaw was found when an OpenSSL security provider is used with Wildfly, the… CVSS 3.1CRITICAL 9.1
  • TI-2019-02903 It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in… CVSS 3.1HIGH 8.8
  • TI-2020-08639 Deserialization of untrusted data in [UNKNOWN] wildfly CVSS 3.1HIGH 7.5
  • TI-2020-08617 A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded… CVSS 3.1HIGH 7.5
  • TI-2022-01162 A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and… CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences