CVE-2019-14887

EUVD-2019-5996 · Published Mar 16, 2020

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.

Technologies

Redhat Jboss Data GridRedhat WildflyRedhat Jboss FuseRedhat Jboss Enterprise Application PlatformRedhat Openshift Application RuntimesRedhat Single Sign-On

Weaknesses

CWE-757NVD-CWE-Other

CVSS scores

v3.19.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
v2.06.4AV:N/AC:L/Au:N/C:P/I:P/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Defense Impairment

T1190Exploit Public-Facing Application T1600Weaken Encryption

References

Potentially impacted assets

See if this affects your attack surface