Read the docs
TI-2019-11064 Aliases CVE-2019-14860GHSA-xw65-g8p2-hc6q

It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to…

Priority LOW 31CWE-942Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.

Why it matters now

EPSS 0.01165 67th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]syndesisall versions—No fix listedCNA
  • syndesis Vendor[UNKNOWN] Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:fuse:*:*:*:*:*:*:*:*before 7.5.0VulnerableRed Hat
cpe:2.3:a:redhat:syndesis:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:fuse:*:*:*:*:*:*:*:* Versions before 7.5.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:syndesis:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2019:3892 Released 2019-11-14 · Red Hat rating Important
    Red Hat Fuse 7.5.0 security update
    • Red Hat Fuse 7.5.0
  • RHSA-2019:3244 Released 2019-10-29 · Red Hat rating Important
    Red Hat Fuse 7.4.1 security update
    • Red Hat Fuse 7.4.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7.4.1Fixed RHSA-2019:3244
Red Hat Fuse 7.5.0Fixed RHSA-2019:3892

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14860
  2. 2026-10-03 Alias added: GHSA-xw65-g8p2-hc6q

References

Advisory 2

  • TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-01295 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences