CVE-2020-1748 — Incorrect Authorization in WildFly Elytron

Description

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources.

Affected products

Vendor	Product	Affected	Fixed
—	Wildfly	before wildfly-elytron-1.6.8.Final-redhat-00001	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 7	eap7-dom4j	2.1.3-1.redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.2.5-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.5-13.SP3_redhat_00011.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hal-console	3.0.23-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hibernate +4	5.3.17-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hibernate-validator +1	6.0.20-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-infinispan +8	9.4.19-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.22-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.10.4-1.redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-jackson-databind	2.9.10.4-1.redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-genericjms	2.0.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-jsf-api_2.3_spec	2.3.5-7.SP2_redhat_00005.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-logmanager	2.1.15-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-modules	1.8.10-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-server-migration +23	1.3.1-13.Final_redhat_00014.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-server-migration-eap7.3-server +6	1.7.1-7.Final_redhat_00009.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-jboss-xnio-base	3.7.6-4.SP3_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-netty +1	4.1.48-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-resteasy +19	3.6.1-10.SP9_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-undertow	2.0.30-4.SP4_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-weld-ejb +6	3.0.6-4.Final_redhat_00004.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly +2	7.2.9-4.GA_redhat_00003.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-common	1.5.2-1.Final_redhat_00002.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-wildfly-elytron	1.6.8-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-elytron-tool	1.10.7-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.22-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk8 +1	7.2.9-4.GA_redhat_00003.1.el7eap	RHSA-2020:3638, RHSA-2020:3462
Red Hat JBoss EAP 7	eap7-wildfly-transaction-client	1.1.11-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.wildfly.security:wildfly-elytron	< 1.6.8	1.6.8	GHSA-qgrq-cx4c-2rmm

Advisories 7

RHSA-2020:3462 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3463 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3461 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3639 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
WID-SEC-2022-1912 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2025

Incorrect Authorization in WildFly Elytron