Skip to content
Fencer Vulns
high 7.5

CVE-2020-10718 json

A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thre…

published 2020-09-16 6 y ago modified 2026-09-08 2 mo ago also BIT-wildfly-2020-10718 , EUVD-2020-3147

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.

Patch / fix

  • bitnami wildfly 13.0.0
  • redhat wildfly 13.0.0
  • eap7-dom4j jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.1.3-1.redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.2 7.2.9-4.GA_redhat_00003.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.2 3.6.1-10.SP9_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.0.30-4.SP4_redhat_00001.1.el8eap
  • eap7-weld-ejb jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-weld-jta jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-weld-web jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-hibernate jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 5.3.17-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2020:3639RHSA-2020:3638RHSA-2020:3637RHSA-2020:3463RHSA-2020:3462RHSA-2020:3461

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-10718 updated cvss 5.9

wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API

  • Red Hat Fuse 7 wildfly wildfly
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Data Grid 7 wildfly wildfly Red Hat JBoss Data Virtualization 6 jbossas jbossas, wildfly wildfly Red Hat JBoss Enterprise Application Platform 5 jbossas jbossas Red Hat JBoss Enterprise Application Platform 6 jbossas jbossas Red Hat JBoss Enterprise Application Platform Continuous Delivery wildfly wildfly Red Hat JBoss Operations Network 3 wildfly wildfly
    +1 more products
    Red Hat JBoss SOA Platform 5 jbossas jbossas
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes wildfly wildfly
    affected: no fix available
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el6eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el6eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el6eap, +83 more
    fixed: vendor fix RHSA-2020:3637
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el7eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el7eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el7eap, +85 more
    fixed: vendor fix RHSA-2020:3638
  • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el8eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el8eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el8eap, +83 more
    fixed: vendor fix RHSA-2020:3639
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el8eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el8eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el8eap, +75 more
    fixed: vendor fix RHSA-2020:3463
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el6eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el6eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el6eap, +75 more
    fixed: vendor fix RHSA-2020:3461
show 5 more
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el7eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el7eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el7eap, +77 more
    fixed: vendor fix RHSA-2020:3462
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2020:3464
  • Red Hat Single Sign-On 7.4.2
    fixed: vendor fix RHSA-2020:3501
  • Red Hat Text-Only RHOAR
    fixed: vendor fix RHSA-2020:3539
  • Red Hat Data Grid 8 wildfly wildfly Red Hat Decision Manager 7 wildfly wildfly Red Hat JBoss Fuse 6 wildfly wildfly Red Hat Process Automation 7 wildfly wildfly
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.44% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami wildfly
<13.0.0
13.0.0

Affected products

  • n/a Wildfly

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.