CVE-2020-1748: Incorrect Authorization in WildFly Elytron

February 15, 2022 (updated June 24, 2022)

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources.

References

bugzilla.redhat.com/show_bug.cgi?id=1807707
github.com/advisories/GHSA-qgrq-cx4c-2rmm
nvd.nist.gov/vuln/detail/CVE-2020-1748
security.netapp.com/advisory/ntap-20201001-0005/

Code Behaviors & Features

Detect and mitigate CVE-2020-1748 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →