GitHub Advisoryadvisory · Maven

GHSA-7fhr-2694-rg79 Session Fixation in WildFly Elytron

HIGH Published 2022-02-15 Modified 2022-11-08 Official page ↗
Aliases
CVE-2020-10714
Ecosystem
Maven
Packages
org.wildfly.security:wildfly-elytron
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-384
Reviewed
2022-06-24

Affected packages

• Maven org.wildfly.security:wildfly-elytron: < 1.11.4 → fixed in 1.11.4

Description

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Related

Alias · CVE (1)

  • CVE-2020-10714 A flaw was found in WildFly Elytron version 1.11.3.Final and before. vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References