What is the CVSS score of CVE-2020-1732?

CVE-2020-1732 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.7%.

Is there a patch available for CVE-2020-1732?

Yes, a patch is available for CVE-2020-1732. Update the affected software to the latest version immediately.

Soteria CVE-2020-1732

MEDIUM

Improper Access Control (CWE-284)

2020-05-04 secalert@redhat.com

Authentication Bypass Soteria Jboss Enterprise Application Platform Jboss Enterprise Application Platform Continuous Delivery Openshift Application Runtimes

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

May 04, 2020 - 17:15 nvd

MEDIUM 4.2

DescriptionNVD

A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request.

AnalysisAI

A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified under CWE-284. A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request. Affected products include: Redhat Soteria, Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Continuous Delivery, Redhat Openshift Application Runtimes. Version information: before 1.0.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.