CVE-2019-14862

mediumPriorität · verfolgen · 25EPSS 0.021 · 81. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

2.05% (81st) EPSS

CVSS 4.3 · medium

Is it mine?

17 products

Prüfe deine Angriffsfläche

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-26

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenRed Hat Decision Manager 7redhat_csaf
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2019:4069
BehobenRed Hat Process Automation 7redhat_csaf
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2019:4071

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.7

v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · secalert@redhat.com USAusnutzbarkeit 2.8 · Auswirkung 2.7

v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · Red Hat Product Security US

v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.16.1mediumAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-79USCWE-79USCWE-79USCWE-79US

betroffene Produkte (17)

Betroffene Produkte und Versionsbereiche.

Oracle Fusion Middlewarealle Versionencert_bundDEcpe:/a:oracle:fusion_middleware:-
Red Hat knockout≤ all knockout versions before 3.5.0-betaenisa_euvdEU
MIT Knockout.js≤ 3.4.2fstec_bduRU
Oracle Corp. Business Intelligence Enterprise Edition≤ 12.2.1.4.0fstec_bduRU
Oracle Corp. Business Intelligence Enterprise Edition≤ 5.5.0.0.0fstec_bduRU
Oracle Corp. Business Intelligence Enterprise Edition≤ 12.2.1.3.0fstec_bduRU
Red Hat Inc. Red Hat Process Automation≤ 7fstec_bduRU
knockoutjs knockout≤ 3.4.2nvdUScpe:2.3:a:knockoutjs:knockout:*:*:*:*:*:*:*:*
oracle business intelligence= 12.2.1.3.0nvdUScpe:2.3:a:oracle:business_intelligence:*:*:*:*:*:*:*:*
oracle business intelligence= 12.2.1.4.0nvdUScpe:2.3:a:oracle:business_intelligence:*:*:*:*:*:*:*:*
oracle business intelligence= 5.5.0.0.0nvdUScpe:2.3:a:oracle:business_intelligence:*:*:*:*:*:*:*:*
oracle goldengate= 12.3.0.1.2nvdUScpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*
redhat decision manager= 7.0nvdUScpe:2.3:a:redhat:decision_manager:*:*:*:*:*:*:*:*
redhat process automation= 7.0nvdUScpe:2.3:a:redhat:process_automation:*:*:*:*:*:*:*:*
npm knockout< 3.5.0osvUSpkg:npm/knockout
Red Hat Decision Manager 7alle Versionenfixedredhat_csafUScpe:/a:redhat:jboss_enterprise_brms_platform:7.5
Red Hat Process Automation 7alle Versionenfixedredhat_csafUScpe:/a:redhat:jboss_enterprise_bpms_platform:7.5

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2019:4069Red Hat Security Advisory: Red Hat Decision Manager 7.5.1 Security Update2019-12-03csaf · redhat_csafUS
An update is now available for Red Hat Decision Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2019:4071Red Hat Security Advisory: Red Hat Process Automation Manager 7.5.1 Security Update2019-12-03csaf · redhat_csafUS
An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2024-2181Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2020-07-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.
GHSA-vcjj-xf2r-mwvcXSS in knockout2020-04-01ghsa · osvUS
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund nvd osv redhat_csaf NVD CVE.org MITRE

veröffentlicht 2020-01-02geändert 2026-06-17

Referenzen (22)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan