Cross-site scripting in Red Hat knockout
Priority LOW 31CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
Why it matters now
EPSS 0.02053 81st percentileScored 2026-11-07
Fix Fixed knockout (npm): 3.5.0Red Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | knockout | before 3.5.0-beta | 3.5.0-beta | Patch available | CNA |
| — | knockout (npm) | before 3.5.0 | 3.5.0 | Patch available | GHSA-vcjj-xf2r-mwvc |
- knockout VendorRed Hat Affected before 3.5.0-beta Fixed in 3.5.0-beta Patch available CNA
- knockout (npm) Vendor— Affected before 3.5.0 Fixed in 3.5.0 Patch available GHSA-vcjj-xf2r-mwvc
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:knockoutjs:knockout:*:*:*:*:*:*:*:* | up to 3.4.2 | Vulnerable | Knockoutjs |
| cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* | 5.5.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:goldengate:12.3.0.1.2:*:*:*:*:*:*:* | 12.3.0.1.2 | Vulnerable | Oracle |
- cpe:2.3:a:knockoutjs:knockout:*:*:*:*:*:*:*:* Versions up to 3.4.2 Vulnerable ·Knockoutjs
- cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* Versions 5.5.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:goldengate:12.3.0.1.2:*:*:*:*:*:*:* Versions 12.3.0.1.2 Vulnerable ·Oracle
Remediation
- Fix · GHSA-vcjj-xf2r-mwvc knockout (npm) Fixed in 3.5.0 Advisory →
Red Hat 2 advisories
- RHSA-2019:4071 Released 2019-12-03 · Red Hat rating ImportantRed Hat Process Automation Manager 7.5.1 Security Update
- Red Hat Process Automation 7
- RHSA-2019:4069 Released 2019-12-03 · Red Hat rating ImportantRed Hat Decision Manager 7.5.1 Security Update
- Red Hat Decision Manager 7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Fixed | RHSA-2019:4069 |
| Red Hat Process Automation 7 | Fixed | RHSA-2019:4071 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-14862
- 2026-10-03 Alias added: GHSA-vcjj-xf2r-mwvc
References
Patch 4
More Red Hat Decision Manager vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2019-11045 Insufficiently protected credentials in Business-central CVSS 3.1HIGH 7.5
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2018-13721 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-13720 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-13719 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2019-14862 · CVE Program
- CVE-2019-14862 · NVD
- FIRST EPSS
- GHSA-vcjj-xf2r-mwvc · GitHub Advisory Database · CC BY 4.0
- CVE-2019-14862 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences