How severe is CVE-2019-14860?

CVE-2019-14860 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2019-14860 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-14860?

CVE-2019-14860 primarily affects Redhat Fuse. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-14860?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2019-14860 published?

CVE-2019-14860 was published on 2019-11-08 and last updated on 2026-06-17.

CVE-2019-14860

CVE-2019-14860 is a medium-severity vulnerability in Redhat Fuse with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-942.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.3
EPSS exploit prediction: 1% (63rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-942
Affected product: Redhat Fuse
Published: 2019-11-08
Last modified: 2026-06-17

Description

It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.

Frequently asked questions

What is CVE-2019-14860?: It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.
How severe is CVE-2019-14860?: CVE-2019-14860 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2019-14860 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-14860?: CVE-2019-14860 primarily affects Redhat Fuse. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-14860?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2019-14860 published?: CVE-2019-14860 was published on 2019-11-08 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:redhat:fuse:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:syndesis:-:*:*:*:*:*:*:*

More vulnerabilities in Redhat Fuse

CVE-2018-1270 — Critical (CVSS 9.8): Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow…
CVE-2017-5645 — Critical (CVSS 9.8): In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log…
CVE-2016-4437 — Critical (CVSS 9.8): Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote…
CVE-2015-1427 — Critical (CVSS 9.8): The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the…
CVE-2025-12543 — Critical (CVSS 9.6): A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.…
CVE-2019-10174 — High (CVSS 8.8): A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil…

All CVEs affecting Redhat Fuse →

Other CWE-942 vulnerabilities

CVE-2022-26969 — Critical (CVSS 9.8): In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
CVE-2022-31736 — Critical (CVSS 9.8): A malicious website could have learned the size of a cross-origin resource that supported Range requests. This…
CVE-2026-34449 — Critical (CVSS 9.6): SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code…
CVE-2026-30924 — Critical (CVSS 9.6): qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that…
CVE-2026-9739 — Critical (CVSS 9.4): Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented…
CVE-2026-8948 — Critical (CVSS 9.1): Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird…

Browse all CWE-942 vulnerabilities →