Vulnerability · Published Sep 17, 2020 · Assigned by redhat

CVE-2020-14338

Medium 5.3

In plain English

A medium-severity improper input validation in Wildfly. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)1.3%top 29.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	xerces:xercesImpl	2.12.0.sp3	GHSA-w4jq-qh47-hvjq

Affected products (as reported)

Vendor	Product	Versions
n/a	Wildfly	All xerces jboss versions before 2.12.0.SP3

Weakness: CWE-20

References

https://bugzilla.redhat.com/show_bug.cgi?id=1860054 x_refsource_MISC
[xerces-j-users] 20201014 Security vulnerability in 2.12.0 mailing-list, x_refsource_MLIST