CVE-2020-14307

published 2020-07-24

CVE-2020-14307: A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed…

medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
red_hat	wildfly	—	—
redhat	amq	—	—
redhat	jboss_fuse	—	—
redhat	single_sign-on	—	—

CWE-404