What is the CVSS score of CVE-2020-14297?

CVE-2020-14297 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.2%.

Is there a patch available for CVE-2020-14297?

Yes, a patch is available for CVE-2020-14297. Update the affected software to the latest version immediately.

Amq CVE-2020-14297

MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2020-07-24 secalert@redhat.com

Denial Of Service Red Hat Amq Jboss Ejb Client Jboss Enterprise Application Platform Continuous Delivery Jboss Fuse Openshift Application Runtimes Single Sign On

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Jul 24, 2020 - 16:15 nvd

MEDIUM 6.5

DescriptionNVD

A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.

AnalysisAI

A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable. Affected products include: Redhat Amq, Redhat Jboss-Ejb-Client, Redhat Jboss Enterprise Application Platform Continuous Delivery, Redhat Jboss Fuse, Redhat Openshift Application Runtimes.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.