Vulnerability in Red Hat Jboss Operations Network
CVE-2019-3834
It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.
EPSS: 0.010 (60.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Redhat Jboss_operations_network
- Redhat Struts — versions all versions under 1.3.10_1
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-3834?
- CVE-2019-3834 is a high-severity vulnerability in Red Hat Jboss Operations Network, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 7.3/10. Published 2019-10-03.
- How severe is CVE-2019-3834?
- High severity. CVSS v3 base score is 7.3 out of 10.