Skip to content
Fencer Intel
medium 4.2

CVE-2020-1732 json

A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption acros…

published 6y ago modified 4mo ago also EUVD-2020-12577

cvss
4.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request.

Patch / fix

  • redhat soteria 1.0.1
  • eap7-wss4j jboss enterprise application platform 7.2 2.2.5-1.redhat_00001.1.el8eap
  • eap7-jasypt jboss enterprise application platform 7.2 1.9.3-1.redhat_00001.1.el8eap
  • eap7-jgroups jboss enterprise application platform 7.2 4.0.20-2.Final_redhat_00002.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.2 7.2.8-3.GA_redhat_00002.1.el8eap
  • eap7-narayana jboss enterprise application platform 7.2 5.9.8-1.Final_redhat_00002.1.el8eap
  • eap7-opensaml jboss enterprise application platform 7.2 3.3.1-1.redhat_00002.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.2 3.6.1-9.SP8_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.2 2.0.30-2.SP2_redhat_00001.1.el8eap

red hat advisories RHSA-2020:2060RHSA-2020:2059RHSA-2020:2058

Is CVE-2020-1732 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-1732 updated cvss 4.2

Soteria: security identity corruption across concurrent threads

  • Red Hat JBoss Data Virtualization 6 jbossas jbossas, wildfly wildfly Red Hat JBoss Enterprise Application Platform 5 jbossas jbossas Red Hat JBoss Enterprise Application Platform 6 jbossas jbossas Red Hat JBoss Fuse 6 wildfly wildfly Red Hat JBoss Operations Network 3 wildfly wildfly Red Hat JBoss SOA Platform 5 jbossas jbossas
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes wildfly wildfly
    affected: no fix available
  • Red Hat EAP-CD 19 Tech Preview
    fixed: vendor fix RHSA-2020:2333
  • Red Hat JBoss EAP 7.2
    fixed: vendor fix RHSA-2020:2061
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el6eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el6eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el6eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el6eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el6eap, +152 more
    fixed: vendor fix RHSA-2020:2058
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el7eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el7eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el7eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el7eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el7eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el7eap, +154 more
    fixed: vendor fix RHSA-2020:2059
  • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-wss4j 2.2.5-1.redhat_00001.1.el8eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el8eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el8eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el8eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el8eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el8eap, +152 more
    fixed: vendor fix RHSA-2020:2060
  • Red Hat Text-Only RHOAR
    fixed: vendor fix RHSA-2020:2905
show 1 more
  • Red Hat Decision Manager 7 wildfly wildfly Red Hat Fuse 7 wildfly wildfly Red Hat JBoss Data Grid 7 wildfly wildfly Red Hat Process Automation 7 wildfly wildfly Red Hat Single Sign-On 7 Soteria Soteria
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD 2.0 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N

Affected products

  • Red Hat Soteria

Classification

Weakness
  • CWE-284 Improper Access Control
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.