Skip to content
Fencer Vulns
high 7.5

CVE-2020-1748 json

Incorrect Authorization in WildFly Elytron

published 2020-09-16 6 y ago modified 2026-09-10 1 mo ago also GHSA-qgrq-cx4c-2rmm , EUVD-2022-1151

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources.

Patch / fix

  • maven org.wildfly.security:wildfly-elytron 1.6.8
  • redhat wildfly_elytron 1.6.8.final-redhat-00001
  • eap7-dom4j jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.1.3-1.redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.2 7.2.9-4.GA_redhat_00003.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.2 3.6.1-10.SP9_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.0.30-4.SP4_redhat_00001.1.el8eap
  • eap7-weld-ejb jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-weld-jta jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-weld-web jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-hibernate jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 5.3.17-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2020:3639RHSA-2020:3638RHSA-2020:3637RHSA-2020:3463RHSA-2020:3462RHSA-2020:3461

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-1748 updated cvss 4.8

Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain

  • Red Hat Fuse 7 wildfly wildfly
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Data Virtualization 6 jbossas jbossas, wildfly wildfly Red Hat JBoss Enterprise Application Platform 5 jbossas jbossas Red Hat JBoss Enterprise Application Platform 6 jbossas jbossas Red Hat JBoss Enterprise Application Platform Continuous Delivery wildfly wildfly Red Hat JBoss Fuse 6 wildfly wildfly Red Hat JBoss Operations Network 3 wildfly wildfly
    +1 more products
    Red Hat JBoss SOA Platform 5 jbossas jbossas
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes wildfly wildfly
    affected: no fix available
  • Red Hat Data Grid 7.3.7
    fixed: vendor fix RHSA-2020:3779
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el6eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el6eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el6eap, +83 more
    fixed: vendor fix RHSA-2020:3637
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el7eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el7eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el7eap, +85 more
    fixed: vendor fix RHSA-2020:3638
  • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el8eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el8eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el8eap, +83 more
    fixed: vendor fix RHSA-2020:3639
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el8eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el8eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el8eap, +75 more
    fixed: vendor fix RHSA-2020:3463
show 7 more
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el6eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el6eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el6eap, +75 more
    fixed: vendor fix RHSA-2020:3461
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el7eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el7eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el7eap, +77 more
    fixed: vendor fix RHSA-2020:3462
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2020:3464
  • Red Hat Single Sign-On 7.4.2
    fixed: vendor fix RHSA-2020:3501
  • Red Hat RHDM 7.9.0
    fixed: vendor fix RHSA-2020:4960
  • Red Hat RHPAM 7.9.0
    fixed: vendor fix RHSA-2020:4961
  • Red Hat Text-Only RHOAR
    fixed: vendor fix RHSA-2020:3539

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.44% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.wildfly.security:wildfly-elytron
<1.6.8
1.6.8

Affected products

  • n/a Wildfly

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.