WaratekVRT Sign in

CVE-2019-14862 knockout

Affected softwareknockout
Severity6.1 Medium CVSS 3.1 3 scores
WeaknessCross-site scripting (CWE-79)
Published2 Jan 2020
Updated17 Jun 2026

Description

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 2.1% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

6.1 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary published
CVSS 3.0 6.1 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N secalert@redhat.com Secondary
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle GoldenGate / Internal Framework (Knockout) (Prior to 12.3.0.1.2)
Oracle Critical Patch Update January 2021 ↗ CPU 2021-Q1 Oracle Fusion Middleware / Analytics Server (Knockout) (5.5.0.0.0)
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Fusion Middleware / BI Platform Security (Knockout) (12.2.1.3.0, 12.2.1.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Analytics Server (Knockout) 5.5.0.0.0 5.5.0.0.0
Oracle Fusion Middleware BI Platform Security (Knockout) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle GoldenGate Internal Framework (Knockout) Prior to 12.3.0.1.2

Products and versions

5 products, 7 version entries
SourceVendorProductSchemeAffected versions
nvd knockoutjs knockout generic ≤ 3.4.2
nvd oracle business intelligence generic 5.5.0.0.0 · 12.2.1.3.0 · 12.2.1.4.0
nvd oracle goldengate generic 12.3.0.1.2
nvd redhat decision manager generic 7.0
nvd redhat process automation generic 7.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, BI PLATFORM SECURITY (KNOCKOUT), NO AUTH REMOTE EXPLOIT, ANALYTICS SERVER (KNOCKOUT) **Products:** KNOCKOUT, ORACLE FUSION MIDDLEWARE, ORACLE BUSINESS INTELLIGENCE ENTERPRISE EDITION

References

URLTags
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14862 Issue Tracking, Patch, Third Party Advisory
https://snyk.io/vuln/npm:knockout:20180213 Exploit, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch, Third Party Advisory

Timeline
Published2020-01-02By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.