CVE-2018-14627CWE-319

The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required

Medium · published September 4, 2018

CVSS v3.0
5.3
EPSS
1%
Percentile
65.7
In the wild
Unconfirmed
What it is

The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connections: <transport-config confidentiality="required" trust-in-target="supported"/>

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01112 · 65.7th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2018-09-04T12:00Z
EPSS history
Timeline
  • 04 SEP 12:00Z
    The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required
    cvelistv5