Critical severity · published Apr 23, 2019
CVE-2019-7727
In NICE Engage through 6.5, the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces, without restricting registration of MBeans, which…
9.8
CVSS
3.9%
EPSS
No
On KEV
Description
In NICE Engage through 6.5, the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces, without restricting registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol by using the JMX connector. The observed affected TCP port is 6338 but, based on the product's configuration, a different one could be vulnerable.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Engage · Nice
through 6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7727
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7727
Mailing List
http://seclists.org/fulldisclosure/2019/Apr/4
Mitigation
https://redtimmysec.wordpress.com/2019/03/26/jmx-rmi-multiple-applications-rce/
Mailing List
https://seclists.org/bugtraq/2019/Apr/2