CVE-2020-10718 Security feature bypass in Wildfly
Attackers can bypass the security manager via an exposed Thread Context Classloader setting in Wildfly, potentially compromising confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10718?
CVE-2020-10718 is a high-severity vulnerability in Wildfly, published on 16 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.
Which versions are affected by CVE-2020-10718?
1 open source package ship an affected version, including wildfly. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
wildfly Bitnami | All versions | 13.0.0 |
Products include Redhat Jboss Fuse, Redhat Wildfly.
How do I fix CVE-2020-10718?
Upgrade wildfly to 13.0.0 or later.
Is CVE-2020-10718 being exploited?
There is no known exploitation of CVE-2020-10718 in the wild and no public exploit code.
Other vulnerabilities in Wildfly
Sources
Also known as BIT-wildfly-2020-10718, GHSA-wqwx-hvg4-2wh9.