Red Hat Wildfly 7.2.5 Continuous Release 2

CPE Details

Red Hat Wildfly 7.2.5 Continuous Release 2
redhat
wildfly
7.2.5
2020-03-23
16h49 +00:00
2020-03-23
16h49 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:redhat:wildfly:7.2.5:cr2:*:*:*:*:*:*

Informations

Vendor

redhat

Product

wildfly

Version

7.2.5

Update

cr2

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-1278 2022-09-13 11h38 +00:00 A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
7.5
High
CVE-2021-3503 2022-04-18 14h20 +00:00 A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
4.3
Medium
CVE-2020-1719 2021-06-07 14h23 +00:00 A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.
5.4
Medium
CVE-2021-3536 2021-05-20 10h15 +00:00 A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
4.8
Medium
CVE-2020-25640 2020-11-24 18h00 +00:00 A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.
5.3
Medium
CVE-2020-25689 2020-10-29 23h00 +00:00 A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.
6.5
Medium
CVE-2020-10718 2020-09-16 16h06 +00:00 A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.
7.5
High
CVE-2020-10740 2020-06-22 15h39 +00:00 A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.
7.5
High
CVE-2019-14887 2020-03-16 13h48 +00:00 A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.
9.1
Critical
CVE-2019-3805 2019-05-03 17h25 +00:00 A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.
4.7
Medium
CVE-2018-14627 2018-09-04 10h00 +00:00 The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connections:
5.9
Medium