Improper Authorization in WildFly Security Manager - CVE-2019-14843

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU23017

Improper Authorization in WildFly Security Manager - CVE-2019-14843

Published: November 27, 2019


Vulnerability identifier: #VU23017
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14843
CWE-ID: CWE-285
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to improper authorization checks in WidlFly security manager, when running under JDK 11 or 8, that successfully authorizes requests for any requesters . A locally deployed application on the server can gain access to sensitive information.


Affected software

WildFly Security Manager
JBoss Enterprise Application Platform
Red Hat Single Sign-On

How to mitigate CVE-2019-14843

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

JBoss Enterprise Application Platform - addressed in versions 7.2.4, 7.2.5
Red Hat Single Sign-On - update to 7.3.5

External References

Related Security Bulletins