Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2019-14860

Published: Nov 08, 2019 | Modified: Oct 09, 2020
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
7.4 IMPORTANT
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Ubuntu
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2019-14860
CWEhttps://cwe.mitre.org/data/definitions/NVD-Other.html

It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.

Affected Software

Name Vendor Start Version End Version
Fuse Redhat * 7.5.0 (excluding)
Syndesis Redhat - (including) - (including)
Red Hat Fuse 7.4.1 RedHat syndesis-server *
Red Hat Fuse 7.5.0 RedHat syndesis-server *

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2024 Aqua Security Software Ltd.   Privacy Policy | Terms of Use