CVE-2020-25640

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209 CWE-532

Affected software

Vendor	Product	Versions
n/a	wildfly	Wildfly 21.0.0.Final

References

https://bugzilla.redhat.com/show_bug.cgi?id=1881637Issue Tracking, Vendor Advisory
https://github.com/amqphub/amqp-10-resource-adapter/issues/13Third Party Advisory
https://security.netapp.com/advisory/ntap-20201210-0001/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1881637Issue Tracking, Vendor Advisory
https://github.com/amqphub/amqp-10-resource-adapter/issues/13Third Party Advisory
https://security.netapp.com/advisory/ntap-20201210-0001/Third Party Advisory

Timeline

Published: Nov 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-256415.5A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the bloc CVE-2020-256437.2A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by i CVE-2020-256447.5A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacke CVE-2020-256457.5A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is confi CVE-2020-256467.5A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confiden CVE-2020-256477.6A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking CVE-2020-256487.5A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS CVE-2020-256497.5A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to X CVE-2020-25657.5Vulnerability in the Oracle Solaris product of Oracle Systems (component: Consolidation Infrastructure). The supported version that is affec CVE-2020-256505.5A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged l CVE-2020-256516.4A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection CVE-2020-256525.5A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX doma