Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-13517

In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified where existing access privileges are not restricted in coordination with the expiration of access based on active directory user account changes when the device is joined to an AD domain.

Published

2019-09-06T14:15:15.177

Last Modified

2024-11-21T04:25:03.410

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-384
Type: Primary
CWE-384

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	bd	pyxis_enterprise_server	≤ 4.12	Yes
Application	bd	pyxis_es	≤ 1.6.1	Yes

References

https://www.us-cert.gov/ics/advisories/icsma-19-248-01 Mitigation, Third Party Advisory, US Government Resource ([email protected])
https://www.us-cert.gov/ics/advisories/icsma-19-248-01 Mitigation, Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)