CVE-2019-18374 Auth bypass in Critical System Protection (CSP)
Attackers can bypass authentication controls in Symantec Critical System Protection, potentially circumventing security measures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-18374?
CVE-2019-18374 is a critical authentication bypass vulnerability in Symantec Critical System Protection (CSP), published on 25 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing authentication controls.
Weakness: CWE-287
Which versions are affected by CVE-2019-18374?
It affects 1 product.
Products include Broadcom Symantec Critical System Protection.
How do I fix CVE-2019-18374?
No fix has been published for CVE-2019-18374 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-18374 being exploited?
There is no known exploitation of CVE-2019-18374 in the wild and no public exploit code.
Other vulnerabilities in Symantec Critical System Protection (CSP)
Sources
Also known as GHSA-8j5m-96p7-j6g4.