PT-2019-12173 · Gonicus+1 · Gosa+1

Publicado 2019-08-10 · Atualizado 2020-10-28 · CVE-2019-11187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GONICUS GOsa through 2019-04-11

Description The issue allows an attacker to bypass access controls by logging into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided. This is due to an incorrect access control in the LDAP class.

Recommendations For GONICUS GOsa through 2019-04-11, update to a version released after 2019-04-11 to resolve the issue. As a temporary workaround, consider restricting access to the LDAP class to minimize the risk of exploitation. Avoid using usernames containing the substring "success" in the affected system until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2019-11187

DLA-1875-1

DLA-1876-1

USN-4609-1

Produtos afetados

Gosa

Ubuntu

Referências · 15

• https://github.com/gonicus/gosa/commits/master · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11187 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4609-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4609-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-11187 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-14466 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11187 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-11187 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11187 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2019/08/msg00009.html · Nota
• https://ubuntu.com/security/CVE-2019-11187 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-1876-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-1000528 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11187 · Nota de Segurança
• https://osv.dev/vulnerability/DLA-1875-1 · Aviso do Fabricante