CVE-2019-3834CWE-470

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON)

Medium · published October 3, 2019

CVSS v3.0
5.6
EPSS
1%
Percentile
62.9
In the wild
Unconfirmed
What it is

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

The record
Technical detail
CVSS v3.0
5.6 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01014 · 62.9th percentile
Weakness
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Published
2019-10-03T13:31Z
EPSS history
Timeline
  • 03 OCT 13:31Z
    It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON)
    cvelistv5