CVE-2019-18641 Missing authorization in n/a
Attackers can access vCard data without proper authorization due to mishandled access controls in the REST controller.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-18641?
CVE-2019-18641 is a critical missing authorization vulnerability in n/a, published on 20 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller.
Which versions are affected by CVE-2019-18641?
It affects 1 product.
Products include Sparkdevnetwork Rock Rms.
How do I fix CVE-2019-18641?
No fix has been published for CVE-2019-18641 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-18641 being exploited?
There is no known exploitation of CVE-2019-18641 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jm4r-px6v-v7q6.