GitHub Advisoryadvisory · Maven

GHSA-qgrq-cx4c-2rmm Incorrect Authorization in WildFly Elytron

HIGH Published 2022-02-15 Modified 2022-06-24 Official page ↗
Aliases
CVE-2020-1748
Ecosystem
Maven
Packages
org.wildfly.security:wildfly-elytron
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-863
Reviewed
2022-06-24

Affected packages

• Maven org.wildfly.security:wildfly-elytron: < 1.6.8 → fixed in 1.6.8

Description

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources.

Related

Alias · CVE (1)

  • CVE-2020-1748 A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References