Description
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=1825714
https://security.netapp.com/advisory/ntap-20201223-0002/
Related Vulnerabilities
CVE-2020-13937 Vulnerability in maven package org.apache.kylin:kylin
CVE-2022-1274 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2020-11988 Vulnerability in maven package org.apache.xmlgraphics:xmlgraphics-commons
CVE-2022-29258 Vulnerability in maven package org.xwiki.platform:xwiki-platform-filter-ui
CVE-2022-24721 Vulnerability in maven package org.cometd.java:cometd-java-oort