CVE-2019-3834: redhat jboss_operations_network Unsafe Reflection

Vulnerability summary

CVE-2019-3834 is a high (CVSS 7.3) Unsafe Reflection vulnerability in redhat jboss_operations_network. EPSS estimates a 1.01% chance of exploitation in the next 30 days, higher than 62.7% of scored vulnerabilities.

Timeline

1. 03-10-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

• CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.