CVEvulnerability

CVE-2019-13517

8.8 HIGH Published 2019-09-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-09-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-384

Description

In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified where existing access privileges are not restricted in coordination with the expiration of access based on active directory user account changes when the device is joined to an AD domain.

Affected configurations

• bd pyxis enterprise server (>= 4.4 <= 4.12) • bd pyxis es (>= 1.3.4 <= 1.6.1)

Related

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References