PT-2019-13383 · Microsoft+1 · Windows Server+2

Published 2019-09-06 · Updated 2019-10-09 · CVE-2019-13517

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pyxis ES versions 1.3.4 through 1.6.1 Pyxis Enterprise Server with Windows Server versions 4.4 through 4.12

Description A vulnerability has been identified where existing access privileges are not restricted in coordination with the expiration of access based on active directory user account changes when the device is joined to an AD domain.

Recommendations For Pyxis ES versions 1.3.4 through 1.6.1, update the access control mechanism to properly restrict privileges based on active directory user account changes. For Pyxis Enterprise Server with Windows Server versions 4.4 through 4.12, ensure that the device properly enforces access restrictions in coordination with active directory updates.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2019-13517

Affected Products

Pyxis Es

Pyxis Enterprise Server

Windows Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-13517 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13517 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsma-19-248-01 · Note