CVE-2020-14519 Missing authorization in CodeMeter

High 7.5 Published 16 Sep 2020 Updated 4 Aug 2024

Attackers can exploit the WebSockets API to alter or create license files, bypassing authorization controls in CodeMeter license servers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-14519?

CVE-2020-14519 is a high-severity missing authorization vulnerability in CodeMeter, published on 16 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515.

Weakness: CWE-346

Which versions are affected by CVE-2020-14519?

It affects 1 product.

Products include Wibu Codemeter.

How do I fix CVE-2020-14519?

No fix has been published for CVE-2020-14519 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-14519 being exploited?

There is no known exploitation of CVE-2020-14519 in the wild and no public exploit code.

Sources

Also known as GHSA-qf8w-r56m-c9xh.