CVE-2019-11661 Missing authorization in Service Manager

High 8.3 Published 18 Sep 2019 Updated 4 Aug 2024

Non-admin users can modify certain tables, leading to unauthorized data access and modification in Micro Focus Service Manager.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-11661?

CVE-2019-11661 is a high-severity missing authorization vulnerability in Micro Focus Service Manager, published on 18 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited to allow unauthorized access and modification of data.

Which versions are affected by CVE-2019-11661?

It affects 1 product.

Products include Microfocus Service Manager.

How do I fix CVE-2019-11661?

No fix has been published for CVE-2019-11661 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-11661 being exploited?

There is no known exploitation of CVE-2019-11661 in the wild and no public exploit code.

Sources

Also known as GHSA-gm2g-pw66-2fvw.