{"answers":{"affected":"3 open source packages ship an affected version, including org.wildfly.bom:wildfly and wildfly. It affects 1 product.","exploited":"There is no known exploitation of CVE-2020-1719 in the wild and no public exploit code.","fix":"Upgrade org.wildfly.bom:wildfly to 20.0.0.Final or later.","what":"CVE-2020-1719 is a medium-severity authentication bypass vulnerability in Wildfly, published on 7 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2020-1719 and fix it if it is affected.\n\nWhat it is: CVE-2020-1719 is a medium-severity authentication bypass vulnerability in Wildfly, published on 7 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2020-1719 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.wildfly.bom:wildfly (Maven): affected all versions; fixed in 20.0.0.Final\n- org.wildfly.bom:wildfly (Maven): affected all versions; fixed in 20.0.0.Final\n- wildfly (Bitnami): affected all versions; fixed in 20.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-1719/ (Markdown: https://insights.sbomify.com/CVE-2020-1719/index.md)","id":"CVE-2020-1719","markdown":"https://insights.sbomify.com/CVE-2020-1719/index.md","name":"CVE-2020-1719","record":{"aliases":["BIT-wildfly-2020-1719","GHSA-p9cf-qjxq-vxw6"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Wildfly application server","requires_auth":"low_privilege","summary":"Attackers can bypass security domain isolation in Wildfly EJBs, potentially accessing or modifying unauthorized data due to improper principal handling.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[{"product":"wildfly","vendor":"redhat"}],"cvss":{"score":5.4,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-270","name":"Privilege Context Switching Error"}],"description":"A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.","ecosystems":["Bitnami","Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Privilege Context Switching Error in wildlfy","id":"CVE-2020-1719","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"auth_bypass","year":"2020"},"n_packages":3,"n_references":1,"next":{"headline":"Missing authorization in postgresql","id":"CVE-2020-1720"},"packages":[{"ecosystem":"Bitnami","fixed":["20.0.0"],"introduced":["0"],"last_affected":[],"package":"wildfly","purl":"pkg:bitnami/wildfly","source":"BIT-wildfly-2020-1719"},{"ecosystem":"Maven","fixed":["20.0.0.Final"],"introduced":["0"],"last_affected":[],"package":"org.wildfly.bom:wildfly","purl":null,"source":"GHSA-p9cf-qjxq-vxw6"},{"ecosystem":"Maven","fixed":["20.0.0.Final"],"introduced":["0"],"last_affected":[],"package":"org.wildfly.bom:wildfly","purl":"pkg:maven/org.wildfly.bom/wildfly","source":"GHSA-p9cf-qjxq-vxw6"}],"prev":{"headline":"Improper Authentication for Keycloak","id":"CVE-2020-1718"},"products":["Wildfly"],"published":"2021-06-07","related":[{"cvss_score":9.8,"headline":"Auth bypass in n/a","id":"CVE-2018-10683","kev_date_added":null,"published":"2018-05-09"},{"cvss_score":6.6,"headline":"Wildfly Unsafe Deserialization Vulnerability","id":"CVE-2020-10740","kev_date_added":null,"published":"2020-06-22"},{"cvss_score":5.9,"headline":"Wildfly has a memory leak vulnerability","id":"CVE-2020-27822","kev_date_added":null,"published":"2020-12-08"},{"cvss_score":5.3,"headline":"Wildfly logs plaintext passwords","id":"CVE-2020-25640","kev_date_added":null,"published":"2020-11-24"},{"cvss_score":5.3,"headline":"Security feature bypass in JBoss/WildFly","id":"CVE-2018-14627","kev_date_added":null,"published":"2018-09-04"},{"cvss_score":4.3,"headline":"Metrics exposure in Wildfly","id":"CVE-2021-3503","kev_date_added":null,"published":"2022-04-18"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["n/a"]},"summary":"Attackers can bypass security domain isolation in Wildfly EJBs, potentially accessing or modifying unauthorized data due to improper principal handling.","url":"https://insights.sbomify.com/CVE-2020-1719/"}