CVE-2019-13517 Auth bypass in BD
Attackers can retain access privileges after Active Directory account changes on Pyxis Enterprise Server, bypassing intended access restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13517?
CVE-2019-13517 is a high-severity authentication bypass vulnerability in BD, published on 6 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified where existing access privileges are not restricted in coordination with the expiration of access based on active directory user account changes when the device is joined to an AD domain.
Weakness: CWE-384
Which versions are affected by CVE-2019-13517?
It affects 2 products.
Products include Bd Pyxis Enterprise Server, Bd Pyxis Es.
How do I fix CVE-2019-13517?
No fix has been published for CVE-2019-13517 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-13517 being exploited?
There is no known exploitation of CVE-2019-13517 in the wild and no public exploit code.
Sources
Also known as GHSA-w5xw-f5v2-6r79.