Medium WID-SEC-2022-2050 8 CVEs

Red Hat JBoss Application Server (JBoss): Mehrere Schwachstellen

Published Jun 11, 2020 · Updated Oct 8, 2026 · Revision 15 · de-DE

Vendor: Oracle Vendor: Red Hat Vendor: Ubuntu Product: Enterprise Linux Product: JBoss Application Server (JBoss) Product: JBoss Enterprise Application Platform Product: Linux Product: Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Red Hat JBoss Application Server (JBoss) ausnutzen, um Informationen offenzulegen, Daten zu manipulieren oder einen Cross-Site Scripting Angriff durchzuführen.

Product

JBoss ist ein OpenSource J2EE Application Server.

Vulnerabilities 8

Critical 9.8

CVE-2020-8840 Public exploit EPSS 27%

Deserialization of Untrusted Data in jackson-databind

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Feb 10, 2020
Critical 9.8

CVE-2020-9546

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Mar 2, 2020
Critical 9.8

CVE-2020-9547 Public exploit Scanner template EPSS 18%

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Mar 2, 2020
Critical 9.8

CVE-2020-9548 Public exploit Scanner template EPSS 19%

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Mar 2, 2020
High 7.5

CVE-2018-14371

Path Traversal in Eclipse Mojarra

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.

org.glassfish:mojarra-parent mojarra Ubuntu Maven

Jul 18, 2018
High 7.5

CVE-2020-1695

Improper Input Validation in RESTEasy

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may res…

Red Hat RESTEasy resteasy resteasy3.0 Debian Ubuntu Maven

May 19, 2020
High 7.5

CVE-2020-6950 Public exploit Scanner template EPSS 10%

Directory traversal in Eclipse Mojarra

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.

org.glassfish:mojarra-parent Maven

Jun 2, 2021
Medium 5.4

CVE-2020-10688

Cross-site scripting in RESTEasy

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS a…

resteasy resteasy3.0 resteasy3.0 org.jboss.resteasy:resteasy-bom Debian Ubuntu Maven

May 27, 2021

Revision history

2026-10-08 #15
Neue Updates von Oracle Linux aufgenommen
2025-07-10 #14
Neue Updates von Ubuntu aufgenommen
2025-02-23 #13
Neue Updates von Red Hat aufgenommen
2022-11-15 #12
Neue Updates von Oracle Linux aufgenommen
2021-08-11 #11
Neue Updates von Red Hat aufgenommen
2021-05-18 #10
Neue Updates von Red Hat aufgenommen
2020-11-30 #9
Referenz(en) aufgenommen: FEDORA-2020-239503F5FA, FEDORA-2020-DF970DA9FC
2020-09-23 #8
Neue Updates von Red Hat aufgenommen
2020-09-17 #7
Neue Updates von Red Hat aufgenommen
2020-09-07 #6
Neue Updates von Red Hat aufgenommen
2020-08-31 #5
Neue Updates von Red Hat aufgenommen
2020-07-28 #4
Neue Updates von Red Hat aufgenommen
2020-07-22 #3
Neue Updates von Red Hat aufgenommen
2020-07-02 #2
Neue Updates von Red Hat aufgenommen
2020-06-11 #1
Initiale Fassung

References

Red Hat Security Advisory RHSA-2020:2511 vom 2020-06-11
https://access.redhat.com/errata/RHSA-2020:2511
Red Hat Security Advisory RHSA-2020:2512 vom 2020-06-11
https://access.redhat.com/errata/RHSA-2020:2512
Red Hat Security Advisory RHSA-2020:2513 vom 2020-06-11
https://access.redhat.com/errata/RHSA-2020:2513
Red Hat Security Advisory RHSA-2020:2515 vom 2020-06-11
https://access.redhat.com/errata/RHSA-2020:2515
Red Hat Security Advisory RHSA-2020:2813 vom 2020-07-02
https://access.redhat.com/errata/RHSA-2020:2813
Red Hat Security Advisory RHSA-2020:2905 vom 2020-07-23
https://access.redhat.com/errata/RHSA-2020:2905
Red Hat Security Advisory RHSA-2020:3192 vom 2020-07-28
https://access.redhat.com/errata/RHSA-2020:3192
Red Hat Security Advisory RHSA-2020:3197 vom 2020-07-29
https://access.redhat.com/errata/RHSA-2020:3197
Red Hat Security Advisory RHSA-2020:3196 vom 2020-07-29
https://access.redhat.com/errata/RHSA-2020:3196
Red Hat Security Advisory RHSA-2020:3585 vom 2020-08-31
https://access.redhat.com/errata/RHSA-2020:3585
Red Hat Security Advisory RHSA-2020:3638 vom 2020-09-07
https://access.redhat.com/errata/RHSA-2020:3638
Red Hat Security Advisory RHSA-2020:3639 vom 2020-09-07
https://access.redhat.com/errata/RHSA-2020:3639
Red Hat Security Advisory RHSA-2020:3642 vom 2020-09-07
https://access.redhat.com/errata/RHSA-2020:3642
Red Hat Security Advisory RHSA-2020:3637 vom 2020-09-07
https://access.redhat.com/errata/RHSA-2020:3637
Red Hat Security Advisory RHSA-2020:3779 vom 2020-09-17
https://access.redhat.com/errata/RHSA-2020:3779
Red Hat Security Advisory RHSA-2020:3806 vom 2020-09-23
https://access.redhat.com/errata/RHSA-2020:3806
Red Hat Security Advisory RHSA-2021:1775 vom 2021-05-18
https://access.redhat.com/errata/RHSA-2021:1775
Red Hat Security Advisory RHSA-2021:3140 vom 2021-08-11
https://access.redhat.com/errata/RHSA-2021:3140
Oracle Linux Security Advisory ELSA-2022-7470 vom 2022-11-15
https://linux.oracle.com/errata/ELSA-2022-7470.html
Red Hat Security Advisory RHSA-2025:1746 vom 2025-02-24
https://access.redhat.com/errata/RHSA-2025:1746
Ubuntu Security Notice USN-7630-1 vom 2025-07-11
https://ubuntu.com/security/notices/USN-7630-1
Oracle Linux Security Advisory ELSA-2026-75573 vom 2026-10-09
https://linux.oracle.com/errata/ELSA-2026-75573.html