CVE-2020-1748: Incorrect Authorization in WildFly Elytron
Summary
CVE-2020-1748: Incorrect Authorization in WildFly Elytron. Affects org.wildfly.security:wildfly-elytron versions < 1.6.8. Fixed in 1.6.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WildFly Elytron is a security framework used in the WildFly application server to provide authentication, authorization, and other security services. It is implemented as a separate module and can be used independently in other applications as well. The framework offers various security features such as identity management, secure communication, and access control. However, a vulnerability has been discovered in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, which allows unauthorized access to secure resources.
Vulnerability Detail
The vulnerability (CVE-2020-1748) in WildFly Elytron arises from a bypass of WildFlySecurityManager checks when using custom security managers. This flaw leads to improper authorization, enabling unauthenticated access to secure resources. As a result, sensitive information may be exposed to unauthorized individuals or entities. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.6.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of WildFly Elytron.
Conclusion
The vulnerability in WildFly Elytron (CVE-2020-1748) allows unauthorized access to secure resources, potentially leading to information exposure. It is crucial to upgrade to the patched version (wildfly-elytron-1.6.8.Final-redhat-00001 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.wildfly.security:wildfly-elytron →
FAQ
WildFly Elytron is a security framework used in the WildFly application server to provide authentication, authorization, and other security services.
This vulnerability allows unauthenticated access to secure resources, potentially exposing sensitive information.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the patched version.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software.
Related vulnerabilities
Recent vulnerabilities recorded for org.wildfly.security:wildfly-elytron.
