What is CVE-2020-10721?

CVE-2020-10721 is a high-severity vulnerability in Red Hat Fabric8-Maven, classified under Deserialization of Untrusted Data. CVSS score: 7.8/10. Published 2020-10-22.

How severe is CVE-2020-10721?

High severity. CVSS v3 base score is 7.8 out of 10.

Deserialization in Red Hat Fabric8-Maven

CVE-2020-10721

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Vulnerability class: Insecure Deserialization

EPSS: 0.006 (44.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Redhat Fabric8-maven
N/a Fabric8-maven-plugin — versions jkube-1.0.0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

secalert@redhat.com (x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2020-10721?: CVE-2020-10721 is a high-severity vulnerability in Red Hat Fabric8-Maven, classified under Deserialization of Untrusted Data. CVSS score: 7.8/10. Published 2020-10-22.
How severe is CVE-2020-10721?: High severity. CVSS v3 base score is 7.8 out of 10.