LiveActive security incident?Get immediate response
CVE Record

CVE-2019-19999: Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_R...

Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

Halo versions before 1.2.0-beta.1 had a server-side template injection issue in its FreeMarker configuration. In business terms, unsafe template handling could let attacker-controlled template content be interpreted on the server. The sources do not provide CVSS, affected deployment details, or confirmed exploitation.

Executive priority

Treat this as a targeted remediation item for any legacy Halo deployment. Prioritize internet-facing or multi-user systems first. Urgency cannot be rated from CVSS because the public source bundle provides no score or exploitation evidence.

Technical view

CVE-2019-19999 is an SSTI in Halo before 1.2.0-beta.1 because FreeMarker was configured without TemplateClassResolver.SAFER_RESOLVER. The public record points to Halo GitHub issues and the v1.1.3-beta.2 to v1.2.0-beta.1 comparison as the remediation context, but gives limited exploitability detail.

Likely exposure

Exposure is limited to organizations running Halo versions before 1.2.0-beta.1, especially where untrusted users can influence templates or template-rendered content. The source bundle does not identify CPEs, deployment types, or authentication requirements.

Exploitation context

The source bundle does not show active exploitation, and KEV is false. SSTI is a serious vulnerability class, but these sources do not confirm exploit preconditions, public weaponization, or observed attacks for this CVE.

Researcher notes

The record is sparse: no CVSS, CWE, CPE, or exploit prerequisites are supplied. The key technical clue is missing TemplateClassResolver.SAFER_RESOLVER in FreeMarker configuration, with the fix context implied by Halo issues and the v1.2.0-beta.1 comparison.

Mitigation direction

  • Inventory Halo instances and identify versions below 1.2.0-beta.1.
  • Upgrade affected Halo deployments to 1.2.0-beta.1 or later where appropriate.
  • Review Halo vendor issues and release comparison for exact remediation context.
  • Restrict template-management access to trusted administrators.
  • Check logs for suspicious template changes or unexpected rendering errors.

Validation and detection

  • Confirm the deployed Halo version for every internet-facing instance.
  • Verify FreeMarker configuration uses safer class resolution after remediation.
  • Review whether untrusted users can create or modify templates.
  • Check change history for template edits before upgrade.
  • Document remediation evidence and remaining unsupported instances.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-19999 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.