CVE-2020-14299

Published: Oct 16, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user and password. The highest threat to vulnerability is to system availability.

Affected (3)

Products: Redhat: Jboss Enterprise Application Platform, Openshift Application Runtimes, Single Sign On

3 products

Jboss Enterprise Application Platform

Openshift Application Runtimes

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Before 5.0.3
Redhat Openshift Application Runtimes	All versions
Redhat Single Sign On	Version 7.0

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://bugzilla.redhat.com/show_bug.cgi?id=1848533

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1848533

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.