PT-2019-12173 · Gonicus+1 · Gosa+1

Published 2019-08-10 · Updated 2020-10-28 · CVE-2019-11187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GONICUS GOsa through 2019-04-11

Description The issue allows an attacker to bypass access controls by logging into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided. This is due to an incorrect access control in the LDAP class.

Recommendations For GONICUS GOsa through 2019-04-11, update to a version released after 2019-04-11 to resolve the issue. As a temporary workaround, consider restricting access to the LDAP class to minimize the risk of exploitation. Avoid using usernames containing the substring "success" in the affected system until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-11187

DLA-1875-1

DLA-1876-1

USN-4609-1

Affected Products

Gosa

Ubuntu

References · 15

• https://github.com/gonicus/gosa/commits/master · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11187 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4609-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4609-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11187 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14466 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11187 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11187 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11187 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11187 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1876-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000528 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11187 · Security Note
• https://osv.dev/vulnerability/DLA-1875-1 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00009.html · Note