Description

A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request.

Remediation

References

CVE-2020-1732

Related Vulnerabilities

Magento Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2020-9578)

Apache Tomcat Improper Access Control Vulnerability (CVE-2016-5388)

Ruby Inadequate Encryption Strength Vulnerability (CVE-2021-32066)

Drupal Core 9.0.x Cross-Site Request Forgery (9.0.0 - 9.0.14)

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-8398)

Severity

Medium

Classification

CVE-2020-1732 CWE-20 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities