Read the docs
TI-2019-11090 Aliases CVE-2019-14886GHSA-5prq-gjqm-96r8

Cleartext storage of sensitive information in Red Hat Business-central

Priority LOW 29CWE-312Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-312.

Summary

A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_security_context. The encoding used for storing the passwords is Base64, not an encryption algorithm, and any recovery of these passwords could lead to user passwords being exposed.

Why it matters now

EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatBusiness-centralversions of Business-central as shipped in rhdm-7.5.1 and rhpam-7.5.1—No fix listedCNA
  • Business-central VendorRed Hat Affected versions of Business-central as shipped in rhdm-7.5.1 and rhpam-7.5.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:decision_manager:7.5.1:*:*:*:*:*:*:*7.5.1VulnerableRed Hat
cpe:2.3:a:redhat:process_automation_manager:7.5.1:*:*:*:*:*:*:*7.5.1VulnerableRed Hat
  • cpe:2.3:a:redhat:decision_manager:7.5.1:*:*:*:*:*:*:* Versions 7.5.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:process_automation_manager:7.5.1:*:*:*:*:*:*:* Versions 7.5.1 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2020:0133 Released 2020-01-16 · Red Hat rating Moderate
    Red Hat Decision Manager 7.6.0 Security Update
    • Red Hat Decision Manager 7
  • RHSA-2020:0132 Released 2020-01-16 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.6.0 Security Update
    • Red Hat Process Automation 7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7Fixed RHSA-2020:0133
Red Hat Process Automation 7Fixed RHSA-2020:0132

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14886
  2. 2026-10-03 Alias added: GHSA-5prq-gjqm-96r8

References

Advisory 1

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2019-11045 Insufficiently protected credentials in Business-central CVSS 3.1HIGH 7.5
  • TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2018-13721 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
  • TI-2018-13720 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
  • TI-2018-13719 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences