← Vulnerability feed

Vulnerability record · CVE-2019-14886 · published 5 March 2020

CVE-2019-14886: Redhat decision manager cleartext storage of sensitive data vulnerability

Redhat · Decision Manager

A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_security_context. The encoding used for storing the passwords is Base64, not an encryption algorithm, and any recovery of these passwords could lead to user passwords being exposed.

6.5 CVSS 3.1 Medium EPSS 0.29% · top 80.4% CWE-312 · Cleartext storage of sensitive data
6.5CVSS 3.1 base score, v2 4.0
0.29%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_security_context. The encoding used for storing the passwords is Base64, not an encryption algorithm, and any recovery of these passwords could lead to user passwords being exposed.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14886 Issue TrackingThird Party Advisory
https://groups.google.com/forum/?utm_medium=email&utm_source=footer#%21msg/jbpm-usage/74pSuwfGKRU/0oXpmRScBQAJ
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14886 Issue TrackingThird Party Advisory
https://groups.google.com/forum/?utm_medium=email&utm_source=footer#%21msg/jbpm-usage/74pSuwfGKRU/0oXpmRScBQAJ

Track CVE-2019-14886 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed9.8CVE-2022-2457Redhat process automation manager improper restriction of authentication attempts vulnerabilityA flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as th…EPSS 0.59%9.8CVE-2019-14892Fasterxml jackson-databind information exposure vulnerabilityA flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a mal…EPSS 5.6%9.8CVE-2018-19362Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core cla…EPSS 11%9.8CVE-2018-19360Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms c…EPSS 11%9.8CVE-2018-19361Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from po…EPSS 11%8.8CVE-2022-1415Redhat decision manager deserialization of untrusted data vulnerabilityA flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated a…EPSS 1.0%8.8CVE-2019-14841Redhat decision manager vulnerabilityA flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to …EPSS 0.67%

Source: NIST National Vulnerability Database (record CVE-2019-14886), CISA KEV, FIRST EPSS (scores of 2026-10-02). This page is refreshed as NVD updates the record.