Search for vulnerabilities
Vulnerability details: VCID-m89y-hqwv-aaar
Vulnerability ID VCID-m89y-hqwv-aaar
Aliases CVE-2020-27822
GHSA-qx3p-9mmp-4v8h
Summary A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. The highest threat from this vulnerability is to system availability.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-401 Missing Release of Memory after Effective Lifetime
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
rhas Important https://access.redhat.com/errata/RHSA-2021:0246
rhas Important https://access.redhat.com/errata/RHSA-2021:0247
rhas Important https://access.redhat.com/errata/RHSA-2021:0248
rhas Important https://access.redhat.com/errata/RHSA-2021:0250
rhas Important https://access.redhat.com/errata/RHSA-2021:0295
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0317
rhas Important https://access.redhat.com/errata/RHSA-2021:0327
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-27822.json
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
epss 0.00798 https://api.first.org/data/v1/epss?cve=CVE-2020-27822
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1904060
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-qx3p-9mmp-4v8h
cvssv3.1 4.3 https://github.com/wildfly/wildfly
generic_textual MODERATE https://github.com/wildfly/wildfly
cvssv3.1 5.9 https://github.com/wildfly/wildfly/commit/67ef84fd7aab789a535b137e5e506fd29d212455
generic_textual MODERATE https://github.com/wildfly/wildfly/commit/67ef84fd7aab789a535b137e5e506fd29d212455
cvssv3.1 5.9 https://github.com/wildfly/wildfly/commit/c8b02f6a0605f4e2abfeaf21d28b7fe76171004b
generic_textual MODERATE https://github.com/wildfly/wildfly/commit/c8b02f6a0605f4e2abfeaf21d28b7fe76171004b
cvssv3.1 5.9 https://github.com/wildfly/wildfly/pull/13749
generic_textual MODERATE https://github.com/wildfly/wildfly/pull/13749
cvssv3.1 5.9 https://github.com/wildfly/wildfly/pull/13779
generic_textual MODERATE https://github.com/wildfly/wildfly/pull/13779
cvssv3.1 5.9 https://issues.redhat.com/browse/WFLY-14094
generic_textual MODERATE https://issues.redhat.com/browse/WFLY-14094
cvssv2 7.1 https://nvd.nist.gov/vuln/detail/CVE-2020-27822
cvssv3 5.9 https://nvd.nist.gov/vuln/detail/CVE-2020-27822
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2020-27822
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-27822.json
https://api.first.org/data/v1/epss?cve=CVE-2020-27822
https://github.com/wildfly/wildfly
https://github.com/wildfly/wildfly/commit/67ef84fd7aab789a535b137e5e506fd29d212455
https://github.com/wildfly/wildfly/commit/c8b02f6a0605f4e2abfeaf21d28b7fe76171004b
https://github.com/wildfly/wildfly/pull/13749
https://github.com/wildfly/wildfly/pull/13779
https://issues.redhat.com/browse/WFLY-14094
1904060 https://bugzilla.redhat.com/show_bug.cgi?id=1904060
cpe:2.3:a:redhat:wildfly:19.0.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:wildfly:19.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:wildfly:19.1.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:wildfly:19.1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:wildfly:20.0.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:wildfly:20.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:wildfly:20.0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:wildfly:20.0.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:wildfly:21.0.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:wildfly:21.0.0:*:*:*:*:*:*:*
CVE-2020-27822 https://nvd.nist.gov/vuln/detail/CVE-2020-27822
GHSA-qx3p-9mmp-4v8h https://github.com/advisories/GHSA-qx3p-9mmp-4v8h
RHSA-2021:0246 https://access.redhat.com/errata/RHSA-2021:0246
RHSA-2021:0247 https://access.redhat.com/errata/RHSA-2021:0247
RHSA-2021:0248 https://access.redhat.com/errata/RHSA-2021:0248
RHSA-2021:0250 https://access.redhat.com/errata/RHSA-2021:0250
RHSA-2021:0295 https://access.redhat.com/errata/RHSA-2021:0295
RHSA-2021:0317 https://access.redhat.com/errata/RHSA-2021:0317
RHSA-2021:0327 https://access.redhat.com/errata/RHSA-2021:0327
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-27822.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/wildfly/wildfly
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/wildfly/wildfly/commit/67ef84fd7aab789a535b137e5e506fd29d212455
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/wildfly/wildfly/commit/c8b02f6a0605f4e2abfeaf21d28b7fe76171004b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/wildfly/wildfly/pull/13749
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/wildfly/wildfly/pull/13779
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://issues.redhat.com/browse/WFLY-14094
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2020-27822
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-27822
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-27822
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.37749
EPSS Score 0.00087
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.