Skip to content
Fencer Intel
medium 5.3

CVE-2020-1710 json

The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 40…

published 6y ago modified 4mo ago also EUVD-2020-12565

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.

Patch / fix

  • eap7-dom4j jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.1.3-1.redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.2 7.2.9-4.GA_redhat_00003.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.2 3.6.1-10.SP9_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.0.30-4.SP4_redhat_00001.1.el8eap
  • eap7-weld-ejb jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-weld-jta jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-weld-web jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
  • eap7-hibernate jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 5.3.17-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2024:5856RHSA-2020:3639RHSA-2020:3638RHSA-2020:3637RHSA-2020:3463RHSA-2020:3462

Is CVE-2020-1710 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-1710 updated cvss 7.5

EAP: field-name is not parsed in accordance to RFC7230

  • Red Hat JBoss Data Virtualization 6 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 6 jbossweb jbossweb
    affected: workaround, no fix planned “There is currently no known mitigation for this issue.”
  • Red Hat OpenShift Application Runtimes undertow undertow
    affected: workaround, no fix available “There is currently no known mitigation for this issue.”
  • Red Hat Data Grid 7.3.7
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3779
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el6eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el6eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el6eap, +83 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3637
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el7eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el7eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el7eap, +85 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3638
  • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el8eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el8eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el8eap, +83 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3639
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el8eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el8eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el8eap, +75 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3463
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el6eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el6eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el6eap, +75 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3461
show 6 more
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el7eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el7eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el7eap, +77 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3462
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3464
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.7-2.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.45-1.Final_redhat_00001.1.ep7.el7, eap7-infinispan 8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-undertow 1.4.18-12.SP12_redhat_00001.1.ep7.el7, eap7-netty-all 4.1.45-1.Final_redhat_00001.1.ep7.el7, eap7-wildfly-modules 7.1.7-2.GA_redhat_00002.1.ep7.el7, +9 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2024:5856
  • Red Hat Single Sign-On 7.4.2
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3501
  • Red Hat Text-Only RHOAR
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3539
  • Red Hat Decision Manager 7 undertow undertow Red Hat JBoss Web Server 3 tomcat Red Hat JBoss Web Server 5 tomcat Red Hat Process Automation 7 undertow undertow
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • n/a JBoss Enterprise Application Platform

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.