CVE-2019-14860 Misconfiguration in syndesis
An attacker can exploit overly permissive CORS settings to conduct phishing attacks and access unauthorized information in Syndesis.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-14860?
CVE-2019-14860 is a high-severity vulnerability in [UNKNOWN] syndesis, published on 8 Nov 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.
Weakness: CWE-942
Which versions are affected by CVE-2019-14860?
It affects 2 products.
Products include Redhat Fuse, Redhat Syndesis.
How do I fix CVE-2019-14860?
No fix has been published for CVE-2019-14860 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-14860 being exploited?
There is no known exploitation of CVE-2019-14860 in the wild and no public exploit code.
Other vulnerabilities in [UNKNOWN] syndesis
- CVE-2026-41731 In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
- CVE-2021-3690 Undertow vulnerable to memory exhaustion due to buffer leak
- CVE-2025-57849 Fuse: privilege escalation via excessive /etc/passwd permissions
- CVE-2020-10688 Cross-site scripting in RESTEasy
Sources
Also known as GHSA-xw65-g8p2-hc6q.