Read the docs
TI-2019-11043 Aliases CVE-2019-14838GHSA-82v2-f875-73g9

Improper access control in Red Hat wildfly-core

Priority LOW 25CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Privilege escalation
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 11 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284 and CWE-269.

Summary

A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server

Why it matters now

EPSS 0.01141 66th percentileScored 2026-11-07
Fix Partial org.wildfly.core:wildfly-host-controller (Maven): 7.2.5.GARed Hat: 13 advisoriesRed Hat: 11 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatwildfly-corebefore 7.2.5.GA7.2.5.GAPatch availableCNA
—org.wildfly.core:wildfly-host-controller (Maven)before 7.2.5.GA7.2.5.GAPatch availableGHSA-82v2-f875-73g9
  • wildfly-core VendorRed Hat Affected before 7.2.5.GA Fixed in 7.2.5.GA Patch available CNA
  • org.wildfly.core:wildfly-host-controller (Maven) Vendor— Affected before 7.2.5.GA Fixed in 7.2.5.GA Patch available GHSA-82v2-f875-73g9

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:redhat:wildfly_core:7.0.0:-:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:wildfly_core:7.0.0:alpha1:*:*:*:*:*:*7.0.0 alpha1VulnerableRed Hat
cpe:2.3:a:redhat:wildfly_core:7.0.0:alpha2:*:*:*:*:*:*7.0.0 alpha2VulnerableRed Hat
cpe:2.3:a:redhat:wildfly_core:7.0.0:alpha3:*:*:*:*:*:*7.0.0 alpha3VulnerableRed Hat
cpe:2.3:a:redhat:wildfly_core:7.0.0:alpha4:*:*:*:*:*:*7.0.0 alpha4VulnerableRed Hat
cpe:2.3:a:redhat:wildfly_core:7.0.0:alpha5:*:*:*:*:*:*7.0.0 alpha5VulnerableRed Hat
cpe:2.3:a:redhat:wildfly_core:7.0.0:beta1:*:*:*:*:*:*7.0.0 beta1VulnerableRed Hat
cpe:2.3:a:redhat:wildfly_core:7.0.0:cr1:*:*:*:*:*:*7.0.0 cr1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.5:*:*:*:*:*:*:*7.2.5VulnerableRed Hat
  • cpe:2.3:a:redhat:wildfly_core:7.0.0:-:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly_core:7.0.0:alpha1:*:*:*:*:*:* Versions 7.0.0 alpha1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly_core:7.0.0:alpha2:*:*:*:*:*:* Versions 7.0.0 alpha2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly_core:7.0.0:alpha3:*:*:*:*:*:* Versions 7.0.0 alpha3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly_core:7.0.0:alpha4:*:*:*:*:*:* Versions 7.0.0 alpha4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly_core:7.0.0:alpha5:*:*:*:*:*:* Versions 7.0.0 alpha5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly_core:7.0.0:beta1:*:*:*:*:*:* Versions 7.0.0 beta1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly_core:7.0.0:cr1:*:*:*:*:*:* Versions 7.0.0 cr1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.5:*:*:*:*:*:*:* Versions 7.2.5 Vulnerable ·Red Hat
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.3.5:*:*:*:*:*:*:*7.3.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:redhat:data_grid:7.3.4:*:*:*:*:*:*:*7.3.4VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.4:*:*:*:*:*:*:*7.2.4VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:data_grid:7.3.4:*:*:*:*:*:*:* Versions 7.3.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.4:*:*:*:*:*:*:* Versions 7.2.4 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-82v2-f875-73g9 org.wildfly.core:wildfly-host-controller (Maven) Fixed in 7.2.5.GA Advisory →

Red Hat 13 advisories

  • RHSA-2020:2565 Released 2020-06-15 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 18 security update
    • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • RHSA-2020:2067 Released 2020-05-18 · Red Hat rating Important
    Red Hat build of Thorntail 2.5.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:0728 Released 2020-03-05 · Red Hat rating Moderate
    Red Hat Data Grid 7.3.4 security update
    • Red Hat Data Grid 7.3.4
Show 10 more Red Hat advisories
  • RHSA-2019:4045 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update
    • Red Hat Single Sign-On 7.3
  • RHSA-2019:4042 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 8
    • Red Hat Single Sign-On 7.3 for RHEL 8 rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el8sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el8sso
  • RHSA-2019:4040 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 6
    • Red Hat Single Sign-On 7.3 for RHEL 6 Server rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el6sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el6sso
  • RHSA-2019:4041 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 7
    • Red Hat Single Sign-On 7.3 for RHEL 7 Server rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el7sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el7sso
  • RHSA-2019:4019 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-cxf-3.2.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el7eap +47
  • RHSA-2019:4021 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2019:4020 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-cxf-3.2.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el8eap +47
  • RHSA-2019:4018 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-cxf-3.2.10-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el6eap +47
  • RHSA-2019:3082 Released 2019-10-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.2 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-wildfly-7.2.4-2.SP1_redhat_00001.1.el6eap, eap7-wildfly-javadocs-7.2.4-2.SP1_redhat_00001.1.el6eap, eap7-wildfly-modules-7.2.4-2.SP1_redhat_00001.1.el6eap
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-wildfly-7.2.4-2.SP1_redhat_00001.1.el7eap, eap7-wildfly-java-jdk11-7.2.4-2.SP1_redhat_00001.1.el7eap, eap7-wildfly-java-jdk8-7.2.4-2.SP1_redhat_00001.1.el7eap +2
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-wildfly-7.2.4-2.SP1_redhat_00001.1.el8eap, eap7-wildfly-javadocs-7.2.4-2.SP1_redhat_00001.1.el8eap, eap7-wildfly-modules-7.2.4-2.SP1_redhat_00001.1.el8eap
  • RHSA-2019:3083 Released 2019-10-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.2.4 security update
    • Red Hat JBoss EAP 7.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Data Grid 7.3.4Fixed RHSA-2020:0728
Red Hat JBoss EAP 7.2Fixed RHSA-2019:3083
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2019:3082, RHSA-2019:4018
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2019:3082, RHSA-2019:4019
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2019:3082, RHSA-2019:4020
Red Hat JBoss Enterprise Application Platform Continuous DeliveryFixed RHSA-2020:2565
Red Hat Single Sign-On 7.3Fixed RHSA-2019:4045
Red Hat Single Sign-On 7.3 for RHEL 6 ServerFixed RHSA-2019:4040
Red Hat Single Sign-On 7.3 for RHEL 7 ServerFixed RHSA-2019:4041
Red Hat Single Sign-On 7.3 for RHEL 8Fixed RHSA-2019:4042
Text-Only RHOARFixed RHSA-2020:2067
Not affected: 4 products
  • Red Hat Decision Manager 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14838
  2. 2026-10-03 Alias added: GHSA-82v2-f875-73g9

References

Advisory 13

Other 3

  • TI-2015-06239 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data… CVSS 3.0CRITICAL 9.8
  • TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2021-11905 Improper authentication in Red Hat DataGrid and Infinispan CVSS 3.1CRITICAL 9.8
  • TI-2026-22645 Undertow: undertow: request smuggling via inconsistent header parsing CVSS 3.1CRITICAL 9.1
  • TI-2026-22646 Undertow: undertow: request smuggling via malformed http request headers CVSS 3.1CRITICAL 9.1
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences