CVE-2019-7727: Critical severity nice engage vulnerability
In NICE Engage through 6.5, the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces, without restricting registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol by using the JMX connector. The observed affected TCP port is 6338 but, based on the product's configuration, a different one could be vulnerable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7727?
CVE-2019-7727 is considered critical due to the potential for remote code execution.
How do I fix CVE-2019-7727?
To mitigate CVE-2019-7727, configure the JMX/RMI interface to bind only to local interfaces and restrict MBean registration.
What systems are affected by CVE-2019-7727?
CVE-2019-7727 affects NICE Engage versions up to and including 6.5.
What type of attack is possible with CVE-2019-7727?
CVE-2019-7727 allows remote attackers to execute arbitrary code using the RMI protocol through an unauthenticated JMX interface.
Is authentication required to exploit CVE-2019-7727?
No, CVE-2019-7727 does not require authentication to exploit the JMX/RMI interface.