CVE-2019-14838 Wildfly Authorization Misconfiguration
Monitor, Auditor, and Deployer roles can improperly modify server runtime state, allowing unauthorized privilege escalation and configuration changes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-14838?
CVE-2019-14838 is a medium-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 14 Oct 2019. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server
Which versions are affected by CVE-2019-14838?
2 open source packages ship an affected version, including org.wildfly.core:wildfly-host-controller. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
org.wildfly.core:wildfly-host-controller Maven | All versions | 7.2.5.GA |
org.wildfly.core:wildfly-host-controller Maven | All versions | 7.2.5.GA |
Linux distribution packages (11)
eap7-wildfly Red Hat:jboss_enterprise_application_platform:7.2::el6 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el6eap |
eap7-wildfly-javadocs Red Hat:jboss_enterprise_application_platform:7.2::el6 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el6eap |
eap7-wildfly-modules Red Hat:jboss_enterprise_application_platform:7.2::el6 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el6eap |
eap7-wildfly Red Hat:jboss_enterprise_application_platform:7.2::el7 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el7eap |
eap7-wildfly-java-jdk11 Red Hat:jboss_enterprise_application_platform:7.2::el7 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el7eap |
eap7-wildfly-java-jdk8 Red Hat:jboss_enterprise_application_platform:7.2::el7 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el7eap |
eap7-wildfly-javadocs Red Hat:jboss_enterprise_application_platform:7.2::el7 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el7eap |
eap7-wildfly-modules Red Hat:jboss_enterprise_application_platform:7.2::el7 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el7eap |
eap7-wildfly Red Hat:jboss_enterprise_application_platform:7.2::el8 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el8eap |
eap7-wildfly-javadocs Red Hat:jboss_enterprise_application_platform:7.2::el8 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el8eap |
eap7-wildfly-modules Red Hat:jboss_enterprise_application_platform:7.2::el8 | All versions | 0:7.2.4-2.SP1_redhat_00001.1.el8eap |
Products include Redhat Data Grid, Redhat Jboss Enterprise Application Platform, Redhat Single Sign-On, Redhat Wildfly Core.
How do I fix CVE-2019-14838?
Upgrade org.wildfly.core:wildfly-host-controller to 7.2.5.GA or later.
Is CVE-2019-14838 being exploited?
There is no known exploitation of CVE-2019-14838 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2015-7501 Deserialization of Untrusted Data in Apache commons collections
- CVE-2025-23368 Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-82v2-f875-73g9, RHSA-2019:3082.