Read the docs
TI-2019-02846 Aliases CVE-2019-3834GHSA-r4h2-77r7-2xch

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network…

Priority LOW 34CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

Why it matters now

EPSS 0.01014 63rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatstrutsall versions under 1.3.10_1—No fix listedCNA
  • struts VendorRed Hat Affected all versions under 1.3.10_1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_operations_network:*:*:*:*:*:*:*:*after 3.2.1, before 3.3.11VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_operations_network:*:*:*:*:*:*:*:* Versions after 3.2.1, before 3.3.11 Vulnerable ·Red Hat

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat JBoss Operations Network 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3834
  2. 2026-10-03 Alias added: GHSA-r4h2-77r7-2xch

References

Advisory 1

  • TI-2015-06239 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data… CVSS 3.0CRITICAL 9.8
  • TI-2021-02983 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVSS 3.1HIGH 7.5
  • TI-2016-05419 The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not… CVSS 3.0CRITICAL 9.8
  • TI-2016-03164 The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers… CVSS 3.0CRITICAL 9.8
  • TI-2013-01934 ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss… CVSS 2.0HIGH 7.5
  • TI-2015-00262 Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs… CVSS 2.0HIGH 9.0
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences