GHSA-p9cf-qjxq-vxw6

Source

https://github.com/advisories/GHSA-p9cf-qjxq-vxw6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-p9cf-qjxq-vxw6/GHSA-p9cf-qjxq-vxw6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-p9cf-qjxq-vxw6

Aliases

Published

2021-06-08T18:52:27Z

Modified

2023-12-06T00:45:18.126398Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Privilege Context Switching Error in wildlfy

Details

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.

Database specific

{
    "nvd_published_at": "2021-06-07T17:15:00Z",
    "github_reviewed_at": "2021-06-08T17:28:03Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-270"
    ]
}

References

Affected packages

Maven / org.wildfly.bom:wildfly

Package

Name: org.wildfly.bom:wildfly; View open source insights on deps.dev
Purl: pkg:maven/org.wildfly.bom/wildfly

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

20.0.0.Final

Affected versions

11.*

11.0.0.Alpha1

11.0.0.Alpha2

11.0.0.Beta1

11.0.0.Beta2

11.0.0.Beta3

11.0.0.CR1

11.0.0.Final

12.*

12.0.0.CR1

12.0.0.Final

13.*

13.0.0.Alpha1

13.0.0.Alpha2

13.0.0.Alpha3

13.0.0.Alpha5

13.0.0.Final

14.*

14.0.0.Alpha1

14.0.0.Beta2

14.0.0.Final

14.0.1.Final

15.*

15.0.0.Beta1

15.0.0.Final

15.0.1.Final

16.*

16.0.0.Beta1

16.0.0.Final

17.*

17.0.0.Beta1

17.0.0.Final

17.0.1.Final

18.*

18.0.0.Beta1

18.0.0.Final

18.0.1.Final

19.*

19.0.0.Beta1

19.0.0.Beta2

19.0.0.Beta3

19.0.0.Final

19.0.1.Final

19.1.0.Final

20.*

20.0.0.Beta1

Database specific

{
    "last_known_affected_version_range": "<= 19.1.0.Final"
}