CVE-2020-14307

Published: Jul 24, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.

Affected (5)

Products: Redhat: Amq, Jboss Enterprise Application Platform Continuous Delivery, Jboss Fuse, Openshift Application Runtimes, Single Sign On

Redhat

5 products

Amq

Jboss Enterprise Application Platform Continuous Delivery

Jboss Fuse

Openshift Application Runtimes

Single Sign On

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Redhat Amq	Version 2.0
Redhat Jboss Enterprise Application Platform Continuous Delivery	All versions
Redhat Jboss Fuse	Version 6.0.0
Redhat Openshift Application Runtimes	All versions
Redhat Single Sign On	Version 7.0

Related CWEs

CWE-404

Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

References (2)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.