CVE-2019-14838

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-14 · updated 2026-06-17
Weakness: CWE-284

Description

A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server

Affected products

RedHat Data Grid: 7.3.4
Red Hat JBoss EAP: 7.2.0, 7.2.5, 7.3.0, 7.2.4
Red Hat Single Sign-On: 7.3.5
RedHat Wildfly Core: 7.0.0, 7.0.0-alpha1, 7.0.0-alpha2, 7.0.0-alpha3, 7.0.0-alpha4, 7.0.0-alpha5 (+2)

References

https://access.redhat.com/errata/RHSA-2019:3082
https://access.redhat.com/errata/RHSA-2019:3083
https://access.redhat.com/errata/RHSA-2019:4018
https://access.redhat.com/errata/RHSA-2019:4019
https://access.redhat.com/errata/RHSA-2019:4020
https://access.redhat.com/errata/RHSA-2019:4021
https://access.redhat.com/errata/RHSA-2019:4040
https://access.redhat.com/errata/RHSA-2019:4041
https://access.redhat.com/errata/RHSA-2019:4042
https://access.redhat.com/errata/RHSA-2019:4045
https://access.redhat.com/errata/RHSA-2020:0728
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14838

Get alerted when CVE-2019-14838 or the next vulnerability affects your stack