CVE-2020-10714 Session Fixation in WildFly Elytron

What is CVE-2020-10714?

CVE-2020-10714 is a high-severity authentication bypass vulnerability in Netapp Oncommand Insight, published on 23 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Weakness: CWE-384

Which versions are affected by CVE-2020-10714?

2 open source packages ship an affected version, including org.wildfly.security:wildfly-elytron. It affects 6 products.

Products include Netapp Oncommand Insight, Redhat Codeready Studio, Redhat Descision Manager, Redhat Jboss Fuse, Redhat Process Automation, Redhat Wildfly Elytron.

How do I fix CVE-2020-10714?

Upgrade org.wildfly.security:wildfly-elytron to 1.11.4 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-10714 being exploited?

There is no known exploitation of CVE-2020-10714 in the wild and no public exploit code.

Other vulnerabilities in Netapp Oncommand Insight

• CVE-2017-5600 Hardcoded credentials in n/a Critical 9.8
• CVE-2018-1258 Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass High 8.8
• CVE-2020-5421 RFD Protection Bypass via jsessionid High 8.7
• CVE-2022-38733 Auth bypass in OnCommand Insight High 8.6
• CVE-2023-22102 MySQL Connectors takeover vulnerability High 8.3

All Netapp Oncommand Insight vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7fhr-2694-rg79.