GCVE - cpe:2.3:a:redhat:wildfly_elytron:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:redhat:wildfly_elytron:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Redhat (`e942785a-ca89-506e-bd99-50782639cde3`)
Product	Wildfly Elytron (`5e068202-1089-5383-9eef-41c917cfd6ab`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/wildfly-security/wildfly-elytron`	purl2cpe	2026-06-01 10:12:54.921908
`pkg:maven/org.wildfly.security/wildfly-elytron`	purl2cpe	2026-06-01 10:12:54.921910

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-3642`	vulnerable	2026-06-08 05:33:53.260243	Details available A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. Published: 2021-08-05T20:48:01.000Z Updated: 2024-08-03T17:01:07.598Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1981407	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-1748`	vulnerable	2026-06-08 05:21:02.955960	Details available A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources. Published: 2020-09-16T15:27:36.000Z Updated: 2024-08-04T06:46:30.892Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1807707 https://security.netapp.com/advisory/ntap-20201001-0005/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-10714`	vulnerable	2026-06-08 05:16:35.712170	Details available A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Published: 2020-09-23T12:28:17.000Z Updated: 2024-08-04T11:14:14.215Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1825714 https://security.netapp.com/advisory/ntap-20201223-0002/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.