CVE-2020-10714 — Session Fixation in WildFly Elytron

Description

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected products

Vendor	Product	Affected	Fixed
—	wildfly-elytron	wildfly-elytron 1.10.7.Final	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 7	eap7-dom4j	2.1.3-1.redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.2.5-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.5-13.SP3_redhat_00011.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hal-console	3.0.23-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hibernate +4	5.3.17-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hibernate-validator +1	6.0.20-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-infinispan +8	9.4.19-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.22-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.10.4-1.redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-jackson-databind	2.9.10.4-1.redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-genericjms	2.0.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-jsf-api_2.3_spec	2.3.5-7.SP2_redhat_00005.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-logmanager	2.1.15-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-modules	1.8.10-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-server-migration +23	1.3.1-13.Final_redhat_00014.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-server-migration-eap7.3-server +6	1.7.1-7.Final_redhat_00009.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-jboss-xnio-base	3.7.6-4.SP3_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-netty +1	4.1.48-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-resteasy +19	3.6.1-10.SP9_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-undertow	2.0.30-4.SP4_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-weld-ejb +6	3.0.6-4.Final_redhat_00004.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly +2	7.2.9-4.GA_redhat_00003.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-common	1.5.2-1.Final_redhat_00002.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-wildfly-elytron	1.6.8-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-elytron-tool	1.10.7-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.22-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk8 +1	7.2.9-4.GA_redhat_00003.1.el7eap	RHSA-2020:3638, RHSA-2020:3462
Red Hat JBoss EAP 7	eap7-wildfly-transaction-client	1.1.11-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.wildfly.security:wildfly-elytron	< 1.11.4	1.11.4	GHSA-7fhr-2694-rg79

Advisories 7

RHSA-2020:3462 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3463 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3461 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3639 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
WID-SEC-2022-1912 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2025

Session Fixation in WildFly Elytron