CVE-2019-11489 Privilege escalation in n/a
Authenticated low-privilege users can elevate to full admin rights via crafted HTTP PUT requests in SimplyBook.me Enterprise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11489?
CVE-2019-11489 is a high-severity vulnerability in n/a, published on 25 Apr 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incorrect Access Control in the Administrative Management Interface in SimplyBook.me Enterprise before 2019-04-23 allows Authenticated Low-Priv Users to Elevate Privileges to Full Admin Rights via a crafted HTTP PUT Request, as demonstrated by modified JSON data to a /v2/rest/ URI.
Which versions are affected by CVE-2019-11489?
It affects 1 product.
Products include Simplybook Simplybook.
How do I fix CVE-2019-11489?
No fix has been published for CVE-2019-11489 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-11489 being exploited?
There is no known exploitation of CVE-2019-11489 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-m746-3c43-hv27.