CVE-2019-14860: High severity red hat fuse vulnerability
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.
Other sources
Syndesis, the underlying code to Fuse Online, contains a dangerous default for the CORS "setAllowedOrigins" value, as seen here: - https://github.com/syndesisio/syndesis/blob/master/app/server/runtime/src/main/java/io/syndesis/server/runtime/SecurityConfiguration.java#L95 -- configuration.setAllowedOrigins(Arrays.asList(CorsConfiguration.ALL));
With this default in place, any services built on the platform will be open to phishing style attacks by leveraging the lack of cross origin protection.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-14860.
What is the severity of CVE-2019-14860?
The severity of CVE-2019-14860 is high with a severity value of 7.
What is the impact of CVE-2019-14860?
CVE-2019-14860 allows an attacker to conduct phishing attacks and access unauthorized information.
What is the affected software for CVE-2019-14860?
The affected software for CVE-2019-14860 is Syndesis.
How can I fix CVE-2019-14860?
To fix CVE-2019-14860, the Syndesis configuration for Cross-Origin Resource Sharing needs to be restricted to specific trusted origins.