CVE-2019-14862: There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web ap

This month

MEDIUM 6.1WATCHLISTUPGRADEDOWNGRADEDOWNGRADE

CVE-2019-14862 is a medium-severity flaw (CVSS 6.1) affecting knockout, decision manager, process automation. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

Why this priority

Public exploit reference
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	6.1 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	2.1% (top 19%)
CISA exploited list	No
Weakness	CWE-79
Published	2020-01-02
Last modified	2026-06-17

Publisher (CNA): Red Hat, Inc. · Vendor: knockoutjs · oracle · redhat

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-01-02 15:15 UTCPublished CVE record published
2026-06-17 02:19 UTCUpdated Record last modified

knockoutjs knockout UPGRADE

Affected: <= 3.4.2

Fixed in: newer than 3.4.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy knockout || rpm -q knockout || knockout --version

2. UPGRADE to newer than 3.4.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade knockout

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade knockout

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

redhat decision manager DOWNGRADE

Affected: 7.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.0

1. Check installed version

apt-cache policy decision-manager || rpm -q decision-manager || decision-manager --version

2. No fixed release: DOWNGRADE to a release before 7.0 (Debian / Ubuntu)

apt-cache madison decision-manager sudo apt install decision-manager=<VERSION_BEFORE_7.0> sudo apt-mark hold decision-manager

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list decision-manager sudo dnf downgrade decision-manager-<VERSION_BEFORE_7.0> sudo dnf versionlock add decision-manager

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat process automation DOWNGRADE

Affected: 7.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.0

1. Check installed version

apt-cache policy process-automation || rpm -q process-automation || process-automation --version

2. No fixed release: DOWNGRADE to a release before 7.0 (Debian / Ubuntu)

apt-cache madison process-automation sudo apt install process-automation=<VERSION_BEFORE_7.0> sudo apt-mark hold process-automation

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list process-automation sudo dnf downgrade process-automation-<VERSION_BEFORE_7.0> sudo dnf versionlock add process-automation

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle business intelligence DOWNGRADE

Affected: 5.5.0.0.0 · 12.2.1.3.0 · 12.2.1.4.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 5.5.0.0.0

1. Check installed version

apt-cache policy business-intelligence || rpm -q business-intelligence || business-intelligence --version

2. No fixed release: DOWNGRADE to a release before 5.5.0.0.0 (Debian / Ubuntu)

apt-cache madison business-intelligence sudo apt install business-intelligence=<VERSION_BEFORE_5.5.0.0.0> sudo apt-mark hold business-intelligence

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list business-intelligence sudo dnf downgrade business-intelligence-<VERSION_BEFORE_5.5.0.0.0> sudo dnf versionlock add business-intelligence

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle goldengate DOWNGRADE

Affected: 12.3.0.1.2

Fixed in: no fixed release known

Safe to downgrade to: a release before 12.3.0.1.2

1. Check installed version

apt-cache policy goldengate || rpm -q goldengate || goldengate --version

2. No fixed release: DOWNGRADE to a release before 12.3.0.1.2 (Debian / Ubuntu)

apt-cache madison goldengate sudo apt install goldengate=<VERSION_BEFORE_12.3.0.1.2> sudo apt-mark hold goldengate

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list goldengate sudo dnf downgrade goldengate-<VERSION_BEFORE_12.3.0.1.2> sudo dnf versionlock add goldengate

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-14862?

knockout: upgrade to newer than 3.4.2; decision manager: downgrade or apply the listed mitigation; process automation: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2019-14862 being exploited?

CVE-2019-14862 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-14862 affect?

CVE-2019-14862 affects knockout, decision manager, process automation. Severity is medium (CVSS 6.1). There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

How urgent is CVE-2019-14862?

Priority 52/100. Public exploit reference; On your watchlist

References

← Back to latest CVEs