CVE-2019-11187

CRITICAL

GONICUS GOsa < 2019-04-11 - Unauthenticated Incorrect Access Control via LDAP Username Substring

Title source: llm

Description

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided.

References (2)

Core 2

Core References

Patch, Third Party Advisory x_refsource_misc

https://github.com/gonicus/gosa/commits/master

Mailing List, Third Party Advisory x_refsource_confirm

https://lists.debian.org/debian-lts-announce/2019/08/msg00009.html

Scores

CVSS v3 9.8

EPSS 0.0175

EPSS Percentile 75.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-287

Status published

Products (2)

debian/debian_linux 8.0

gonicus/gosa < 2019-04-11

Published Aug 15, 2019

Tracked Since Feb 18, 2026