CVE-2019-3834

State: Published
Severity: 5.6 Medium
Published: Oct 3, 2019
Updated: Aug 4, 2024
Reserved: Jan 3, 2019

Description

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

Scores

CVSS	Score	Vector	Source
3.0	5.6 Medium	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L	redhat

Weaknesses

CWE-470

Affected Products

Product	Versions
strutsRedHat	all versions under 1.3.10_1Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3834

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.