Read the docs
TI-2019-11048 Aliases CVE-2019-14843GHSA-767r-575r-6x2j

Incorrect authorization in Red Hat wildfly-security-manager

Priority MEDIUM 40CWE-592Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped with Red Hat Jboss EAP 7 and Red Hat SSO 7 are vulnerable to this issue.

Why it matters now

EPSS 0.0119 68th percentileScored 2026-11-07
Fix Fixed Red Hat: 11 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatwildfly-security-managerAs shipped with Red Hat Jboss EAP 7 and Red Hat SSO 7—No fix listedCNA
  • wildfly-security-manager VendorRed Hat Affected As shipped with Red Hat Jboss EAP 7 and Red Hat SSO 7 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

Red Hat 11 advisories

  • RHSA-2024:5856 Released 2024-08-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.ep7.el7, eap7-infinispan-8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-infinispan-cachestore-jdbc-8.2.11-1.SP2_redhat_00001.1.ep7.el7 +12
  • RHSA-2019:4045 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update
    • Red Hat Single Sign-On 7.3
  • RHSA-2019:4042 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 8
    • Red Hat Single Sign-On 7.3 for RHEL 8 rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el8sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el8sso
Show 8 more Red Hat advisories
  • RHSA-2019:4040 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 6
    • Red Hat Single Sign-On 7.3 for RHEL 6 Server rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el6sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el6sso
  • RHSA-2019:4041 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 7
    • Red Hat Single Sign-On 7.3 for RHEL 7 Server rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el7sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el7sso
  • RHSA-2019:4019 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-cxf-3.2.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el7eap +47
  • RHSA-2019:4021 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2019:4020 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-cxf-3.2.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el8eap +47
  • RHSA-2019:4018 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-cxf-3.2.10-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el6eap +47
  • RHSA-2019:2973 Released 2019-10-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-wildfly-elytron-1.6.4-3.Final_redhat_00002.1.el6eap
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-wildfly-elytron-1.6.4-3.Final_redhat_00002.1.el7eap
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-wildfly-elytron-1.6.4-3.Final_redhat_00002.1.el8eap
  • RHSA-2019:2974 Released 2019-10-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.4 security update
    • Red Hat JBoss EAP 7.2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss EAP 7.2Fixed RHSA-2019:2974
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2019:2973, RHSA-2019:4018
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2019:2973, RHSA-2019:4019
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2019:2973, RHSA-2019:4020
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2024:5856
Red Hat Single Sign-On 7.3Fixed RHSA-2019:4045
Red Hat Single Sign-On 7.3 for RHEL 6 ServerFixed RHSA-2019:4040
Red Hat Single Sign-On 7.3 for RHEL 7 ServerFixed RHSA-2019:4041
Red Hat Single Sign-On 7.3 for RHEL 8Fixed RHSA-2019:4042
Not affected: 1 product
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14843
  2. 2026-10-03 Alias added: GHSA-767r-575r-6x2j

References

Patch 1

  • TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
  • TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 243 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences