CVE-2020-1748: A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlyS

This month

HIGH 7.5REMOTEWATCHLISTUPGRADEDOWNGRADEDOWNGRADE

CVE-2020-1748 is a high-severity flaw (CVSS 7.5) affecting wildfly elytron, decision manager, process automation. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources.

Why this priority

High severity
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.4% (top 27%)
CISA exploited list	No
Published	2020-09-16
Last modified	2026-06-17

Publisher (CNA): Red Hat, Inc. · Vendor: redhat

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-09-16 16:15 UTCPublished CVE record published
2026-06-17 03:02 UTCUpdated Record last modified

redhat wildfly elytron UPGRADE

Affected: < 1.6.8.final-redhat-00001

Fixed in: 1.6.8.final-redhat-00001

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy wildfly-elytron || rpm -q wildfly-elytron || wildfly-elytron --version

2. UPGRADE to 1.6.8.final-redhat-00001 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade wildfly-elytron

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade wildfly-elytron

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

redhat decision manager DOWNGRADE

Affected: 7.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.0

1. Check installed version

apt-cache policy decision-manager || rpm -q decision-manager || decision-manager --version

2. No fixed release: DOWNGRADE to a release before 7.0 (Debian / Ubuntu)

apt-cache madison decision-manager sudo apt install decision-manager=<VERSION_BEFORE_7.0> sudo apt-mark hold decision-manager

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list decision-manager sudo dnf downgrade decision-manager-<VERSION_BEFORE_7.0> sudo dnf versionlock add decision-manager

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat process automation DOWNGRADE

Affected: 7.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.0

1. Check installed version

apt-cache policy process-automation || rpm -q process-automation || process-automation --version

2. No fixed release: DOWNGRADE to a release before 7.0 (Debian / Ubuntu)

apt-cache madison process-automation sudo apt install process-automation=<VERSION_BEFORE_7.0> sudo apt-mark hold process-automation

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list process-automation sudo dnf downgrade process-automation-<VERSION_BEFORE_7.0> sudo dnf versionlock add process-automation

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-1748?

wildfly elytron: upgrade to 1.6.8.final-redhat-00001; decision manager: downgrade or apply the listed mitigation; process automation: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2020-1748 being exploited?

CVE-2020-1748 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-1748 affect?

CVE-2020-1748 affects wildfly elytron, decision manager, process automation. Severity is high (CVSS 7.5). A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads t

How urgent is CVE-2020-1748?

Priority 55/100. High severity; Remotely exploitable, no login, no user action; On your watchlist

Software pages

JBoss and WildFly vulnerabilities

Related CVEs

CVE-2022-3143 HIGH 7.4 DOWNGRADE DOWNGRADE wildfly-elytron: possible timing attacks via use of unsafe comparator
CVE-2021-3642 MEDIUM 5.3 UPGRADE MITIGATE A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.1

References

← Back to latest CVEs