Not rated
CVE-2020-14338 A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP…
Description
A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Wildfly | Versions not published |
References
- bugzilla.redhat.com bugzilla.redhat.com
- [xerces-j-users] 20201014 Security vulnerability in 2.12.0 lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Wildfly
The 13 CVEs of Wildfly →
CVE-2022-1278
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload…
Not rated
CVE-2021-3717
A flaw was found in Wildfly
Not rated
CVE-2022-0866
This is a concurrency issue that can result in the wrong caller principal being returned from the session context of…
Not rated
CVE-2021-3503
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data
Not rated