Lucene search

[email protected]CVE-2019-14860

HistoryNov 08, 2019 - 3:15 p.m.

CVE-2019-14860

2019-11-0815:15:11

CWE-942

[email protected]

web.nvd.nist.gov

syndesis

cross-origin resource sharing

cve-2019-14860

nvd

information security

phishing

unauthorized access

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.5%

JSON

It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.

Affected configurations

NVD

Node

redhatfuseRange<7.5.0

redhatsyndesisMatch-

CPENameOperatorVersion
redhat:fuseredhat fuselt7.5.0
redhat:syndesisredhat syndesiseq-

CPE	Name	Operator	Version
redhat:fuse	redhat fuse	lt	7.5.0
redhat:syndesis	redhat syndesis	eq	-

CNA Affected

[
  {
    "product": "syndesis",
    "vendor": "[UNKNOWN]",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]