CVE-2020-14307

Опубликовано: 24 июл. 2020

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307
Issue Tracking
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:amq:2.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform_continuous_delivery:-:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*

cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 61%

0.00415

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-404

Связанные уязвимости

CVE-2020-14307

CVSS3: 6.5

redhat

больше 5 лет назад

CVE-2020-14307

CVSS3: 6.5

debian

больше 5 лет назад

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) ver ...

GHSA-q562-x7c7-5fc9

CVSS3: 6.5

github

больше 3 лет назад

EPSS

Процентиль: 61%

0.00415

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-404