CVE-2019-17631

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-285 CWE-269

Affected software

Vendor	Product	Versions
The Eclipse Foundation	Eclipse OpenJ9	0.15 to 0.16 inclusive

References

https://access.redhat.com/errata/RHSA-2019:4113Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4115Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0006Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0046Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=552129Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:4113Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4115Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0006Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0046Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=552129Issue Tracking, Vendor Advisory

Timeline

Published: Oct 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-176326.1In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response conte CVE-2019-176338.8For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of CVE-2019-176349.0Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report fr CVE-2019-176357.8Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is re CVE-2019-176368.1In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/min CVE-2019-176377.1In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be expl CVE-2019-176389.4In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce CVE-2019-176395.3In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the CVE-2019-17648.8A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could all CVE-2019-176409.8In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, CVE-2019-176428.8An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell m CVE-2019-176437.5An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated di