PT-2024-10724 · Opentext · Opentext Accurev

Published 2024-11-26 · Updated 2024-12-17 · CVE-2019-17082

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:I/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions OpenText AccuRev version 2017.1

Description The issue allows authentication bypass, enabling anyone with knowledge of a valid AccuRev username to gain access to AccuRev source control without knowing the user's password. This can occur when the software is installed on a Linux or Solaris system.

Recommendations For version 2017.1, update to a newer version to mitigate the risk, as the current version allows authentication bypass.

Fix

Missing Authentication

Insufficiently Protected Credentials

Weakness Enumeration

CWE-306

CWE-522

Related Identifiers

CVE-2019-17082

Affected Products

Opentext Accurev

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-17082 · Security Note
• https://twitter.com/CVEnew/status/1861504243255193913 · Twitter Post
• https://twitter.com/CveFindCom/status/1861501691251642593 · Twitter Post
• https://support.microfocus.com/kb/kmdoc.php?id=KM03544106 · Note