CVE-2019-4551 Missing authorization in Security Directory Server

What is CVE-2019-4551?

CVE-2019-4551 is a medium-severity missing authorization vulnerability in IBM Security Directory Server, published on 4 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 165953.

Weakness: CWE-306

Which versions are affected by CVE-2019-4551?

It affects 1 product.

Products include Ibm Security Directory Server.

How do I fix CVE-2019-4551?

No fix has been published for CVE-2019-4551 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-4551 being exploited?

There is no known exploitation of CVE-2019-4551 in the wild and no public exploit code.

Other vulnerabilities in IBM Security Directory Server

• CVE-2022-33164 IBM Security Directory Server path traversal High 8.7
• CVE-2019-4520 Security feature bypass in Security Directory Server High 7.5
• CVE-2015-1977 Path traversal in n/a High 7.5
• CVE-2019-4538 Open redirect in Security Directory Server High 7.4
• CVE-2019-4539 XML external entity in Security Directory Server High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-53p8-7gjh-p43g.