CVE-2019-14841

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to gain admin privileges in the Business Central Console.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-281

Affected software

Vendor	Product	Versions
n/a	Business-central	Business-central as shipped in RHDM 7 and RHPAM 7

References

https://access.redhat.com/security/cve/CVE-2019-14841Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1744801Issue Tracking, Vendor Advisory
https://access.redhat.com/security/cve/CVE-2019-14841Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1744801Issue Tracking, Vendor Advisory

Timeline

Published: Oct 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-148429.8Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed CVE-2019-148438.8A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used CVE-2019-148447.5A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending o CVE-2019-148455.3A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image, bypass the TLS hos CVE-2019-148467.8In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG CVE-2019-148474.9A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync res CVE-2019-148495.4A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use CVE-2019-14857.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut CVE-2019-148503.7A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and ca CVE-2019-148516.5A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assert CVE-2019-148527.5A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol CVE-2019-148537.5An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unex