CVE-2020-14297

A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:amq:2.0:::::::*
	cpe:2.3:a:redhat:jboss-ejb-client::::::::
	cpe:2.3:a:redhat:jboss_enterprise_application_platform_continuous_delivery:-:::::::*
	cpe:2.3:a:redhat:jboss_fuse:6.0.0:::::::*
	cpe:2.3:a:redhat:openshift_application_runtimes:-:::::::*
	cpe:2.3:a:redhat:single_sign-on:7.0:::::::*

History

29 Dec 2023, 17:55

Type	Values Removed	Values Added
CPE		cpe:2.3:a:redhat:jboss-ejb-client::::::::
First Time		Redhat jboss-ejb-client

Information

Published : 2020-07-24 16:15

Updated : 2024-02-28 17:47

NVD link : CVE-2020-14297

Mitre link : CVE-2020-14297

CVE.ORG link : CVE-2020-14297

JSON object : View

Products Affected

redhat

jboss-ejb-client
jboss_fuse
amq
openshift_application_runtimes
single_sign-on
jboss_enterprise_application_platform_continuous_delivery

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2020-14297", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-07-24T16:15:11.803", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable."}, {"lang": "es", "value": "Se detect\u00f3 un fallo en Wildfly's EJB Client que se incluy\u00f3 con Red Hat JBoss EAP 7, donde algunos objetos de transacci\u00f3n EJB espec\u00edficos pueden ser acumulados con el tiempo y pueden causar que los servicios se ralenticen y eventualmente no est\u00e9n disponibles. Un atacante puede tomar ventaja y causar un ataque de denegaci\u00f3n de servicio y hacer que los servicios no est\u00e9n disponibles"}], "lastModified": "2023-12-29T17:55:26.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:amq:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6D3AF88-5812-4BB6-871F-C0EA39AD66AE"}, {"criteria": "cpe:2.3:a:redhat:jboss-ejb-client:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09D26C4C-4795-4D49-BA57-7242324B8E2A", "versionEndExcluding": "4.0.34", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform_continuous_delivery:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEFE06C8-4BF0-4EC0-A848-BF16CFCCDA57"}, {"criteria": "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A305F012-544E-4245-9D69-1C8CD37748B1"}, {"criteria": "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A33441B3-B301-426C-A976-08CE5FE72EFB"}, {"criteria": "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}