CVE-2019-11196 Auth bypass in n/a
Unauthenticated attackers can bypass authentication in ValuePLUS IUMS to gain administrator privileges, allowing them to access or modify student data and system settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11196?
CVE-2019-11196 is a critical authentication bypass vulnerability in n/a, published on 12 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypass vulnerability in all versions of ValuePLUS Integrated University Management System (IUMS) allows unauthenticated, remote attackers to gain administrator privileges via the Teachers Web Panel (TWP) User ID or Password field. If exploited, the attackers could perform any actions with administrator privileges (e.g., enumerate/delete all the students' personal information or modify various settings).
Weakness: CWE-89
Which versions are affected by CVE-2019-11196?
It affects 1 product.
Products include Vpcsbd Integrated University Management System.
How do I fix CVE-2019-11196?
No fix has been published for CVE-2019-11196 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-11196 being exploited?
There is no known exploitation of CVE-2019-11196 in the wild and no public exploit code.
Sources
Also known as GHSA-xv8x-7495-j62f.