Skip to content
Fencer Intel
medium 6.6

CVE-2020-10740 json

Wildfly Unsafe Deserialization Vulnerability

published 6y ago modified 2mo ago also BIT-wildfly-2020-10740 , EUVD-2022-5420 , GHSA-vrmw-2xhq-hrmp

cvss
6.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.

Patch / fix

  • maven org.wildfly:wildfly-parent 20.0.0.Final
  • bitnami wildfly 20.0.0
  • redhat wildfly 20.0.0
  • eap7-dom4j jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.1.3-1.redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.2 7.2.9-4.GA_redhat_00003.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.2 3.6.1-10.SP9_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.0.30-4.SP4_redhat_00001.1.el8eap
  • eap7-weld-ejb jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-weld-jta jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-weld-web jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-hibernate jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 5.3.17-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2025:9582RHSA-2020:3639RHSA-2020:3638RHSA-2020:3637RHSA-2020:3463RHSA-2020:3462

Is CVE-2020-10740 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-10740 updated cvss 7.5

wildfly: unsafe deserialization in Wildfly Enterprise Java Beans

  • Red Hat JBoss Data Virtualization 6 jbossas jbossas, wildfly wildfly Red Hat JBoss Enterprise Application Platform 5 jbossas jbossas Red Hat JBoss Enterprise Application Platform 6 jbossas jbossas
    affected: workaround, no fix planned “There is currently no known mitigation for this issue.”
  • Red Hat JBoss Fuse 6 wildfly wildfly
    affected: workaround, no fix available “There is currently no known mitigation for this issue.”
  • Red Hat JBoss Operations Network 3 wildfly wildfly Red Hat JBoss SOA Platform 5 jbossas jbossas
    affected: workaround, no fix planned “There is currently no known mitigation for this issue.”
  • Red Hat OpenShift Application Runtimes wildfly wildfly
    affected: workaround, no fix available “There is currently no known mitigation for this issue.”
  • Red Hat EAP-CD 20 Tech Preview
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3585
  • Red Hat Fuse 7.8.0
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:5568
  • Red Hat JBoss EAP 7.2
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3144
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.8-6.GA_redhat_00003.1.el6eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el6eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el6eap, +93 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3637
show 9 more
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.8-6.GA_redhat_00003.1.el7eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el7eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el7eap, +97 more Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.8-6.GA_redhat_00003.1.el8eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el8eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el8eap, +93 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3142
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.3.1-7.GA_redhat_00004.1.el8, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el8eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el8eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, +85 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3141
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.3.1-7.GA_redhat_00004.1.el6eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el6eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el6eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, +85 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3461
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.1-7.GA_redhat_00004.1.el7eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el7eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el7eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, +89 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3141
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3143
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.11-4.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.63-2.Final_redhat_00003.1.ep7.el7, eap7-undertow 1.4.18-16.SP14_redhat_00001.1.ep7.el7, eap7-glassfish-el 3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate 5.1.17-3.Final_redhat_00004.1.ep7.el7, eap7-netty-all 4.1.63-2.Final_redhat_00003.1.ep7.el7, +19 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2025:9582
  • Red Hat Single Sign-On 7.4.2
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3501
  • Red Hat Text-Only RHOAR
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3539
  • Red Hat Data Grid 8 wildfly wildfly Red Hat Decision Manager 7 wildfly wildfly Red Hat JBoss Data Grid 7 wildfly wildfly Red Hat Process Automation 7 wildfly wildfly
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.07% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.wildfly:wildfly-parent
<20.0.0.Final
20.0.0.Final
bitnami wildfly
<20.0.0
20.0.0

Affected products

  • [UNKNOWN] wildfly

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.