Unrated severityNVD Advisory· Published Jul 9, 2019· Updated Aug 4, 2024
CVE-2019-13337
CVE-2019-13337
Description
In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WESEEK/GROWIdescription
Patches
Vulnerability mechanics
References
1- gist.github.com/polkaman/d039fb5236a043907e44efc198d9161cmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.