GHSA-7fhr-2694-rg79

ghsaUSosv

Session Fixation in WildFly Elytron

view advisory published 2022-02-15Licence: CC-BY-4.0

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-10714US	high7.5	1.45% (73rd)	—	2020-09-23
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a sessio…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=1825714WEB
https://github.com/wildfly-security/wildfly-elytronPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2020-10714ADVISORY
https://security.netapp.com/advisory/ntap-20201223-0002WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan