CVE-2020-25680

MEDIUM

JBCS httpd 2.4.37 SP3 - Improper Certificate Validation

Title source: llm
STIX 2.1

Description

A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and hostname are matching stopped working and allow connecting to the back-end work. The highest threat from this vulnerability is to data integrity.

References (1)

Core 1
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1892703

Scores

CVSS v3 5.4
EPSS 0.0008
EPSS Percentile 23.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Details

CWE
CWE-295
Status published
Products (1)
redhat/jboss_core_services_httpd 2.4.37 sp3
Published Jan 07, 2021
Tracked Since Feb 18, 2026