CVE-2020-1719 Privilege Context Switching Error in wildlfy

What is CVE-2020-1719?

CVE-2020-1719 is a medium-severity authentication bypass vulnerability in Wildfly, published on 7 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.

Weakness: CWE-270

Which versions are affected by CVE-2020-1719?

3 open source packages ship an affected version, including org.wildfly.bom:wildfly and wildfly. It affects 1 product.

Products include Redhat Wildfly.

How do I fix CVE-2020-1719?

Upgrade org.wildfly.bom:wildfly to 20.0.0.Final or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-1719 being exploited?

There is no known exploitation of CVE-2020-1719 in the wild and no public exploit code.

Other vulnerabilities in Wildfly

• CVE-2018-10683 Auth bypass in n/a Critical 9.8
• CVE-2020-10740 Wildfly Unsafe Deserialization Vulnerability Medium 6.6
• CVE-2020-27822 Wildfly has a memory leak vulnerability Medium 5.9
• CVE-2020-25640 Wildfly logs plaintext passwords Medium 5.3
• CVE-2018-14627 Security feature bypass in JBoss/WildFly Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-wildfly-2020-1719, GHSA-p9cf-qjxq-vxw6.