CVE-2019-14886 Information disclosure in Business-central

What is CVE-2019-14886?

CVE-2019-14886 is a medium-severity vulnerability in Red Hat Business-central, published on 5 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_security_context. The encoding used for storing the passwords is Base64, not an encryption algorithm, and any recovery of these passwords could lead to user passwords being exposed.

Weakness: CWE-312

Which versions are affected by CVE-2019-14886?

It affects 2 products.

Products include Redhat Decision Manager, Redhat Process Automation Manager.

How do I fix CVE-2019-14886?

No fix has been published for CVE-2019-14886 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-14886 being exploited?

There is no known exploitation of CVE-2019-14886 in the wild and no public exploit code.

Other vulnerabilities in Red Hat Business-central

• CVE-2019-14841 Privilege escalation in Business-central High 8.8
• CVE-2022-1415 Drools: unsafe data deserialization in streamutils High 8.1
• CVE-2019-14840 Information disclosure in Business-central High 7.5
• CVE-2020-1748 Incorrect Authorization in WildFly Elytron High 7.5
• CVE-2017-7545 XML External Entity Reference in jbpmmigration Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5prq-gjqm-96r8.