CVE-2019-10011

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-25 · updated 2026-06-17
Weakness: CWE-798

Description

ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of accounts with a password of 1234.

Affected products

Jenzabar Internet Campus Solution: before 2019-02-06 — fixed in 2019-02-06

How to fix

Upgrade to a fixed version: Jenzabar Internet Campus Solution 2019-02-06. Check the vendor advisory for mitigations.

References

https://medium.com/%40mdavis332/higher-ed-erp-portal-vulnerability-create-your-own-accounts-d865bd22cdd8
https://medium.com/%40mdavis332/higher-ed-erp-portal-vulnerability-create-your-own-accounts-d865bd22cdd8

Get alerted when CVE-2019-10011 or the next vulnerability affects your stack