CVE-2019-11187

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-08-15 · updated 2026-06-17
Weakness: CWE-287

Description

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided.

Affected products

Debian Linux: 8.0
Gonicus Gosa: through 2019-04-11

References

https://github.com/gonicus/gosa/commits/master
https://lists.debian.org/debian-lts-announce/2019/08/msg00009.html
https://github.com/gonicus/gosa/commits/master
https://lists.debian.org/debian-lts-announce/2019/08/msg00009.html

Get alerted when CVE-2019-11187 or the next vulnerability affects your stack