CVE-2019-13337

 

Published at: - 09-07-2019 10:15

Last modified: - 24-10-2022 07:11

Total changes: - 2

Description

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.

Common Vulnerability Scoring System (CVSS)

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://gist.github.com/polkaman/d039fb5236a043907e44efc198d9161c

 

Keywords

NVD

 

CVE-2019-13337

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures