High severity7.5NVD Advisory· Published Jul 9, 2019· Updated Jun 17, 2026
CVE-2019-13337
CVE-2019-13337
Description
In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- WESEEK/GROWIdescription
Patches
Vulnerability mechanics
References
1- gist.github.com/polkaman/d039fb5236a043907e44efc198d9161cnvdThird Party Advisory
News mentions
0No linked articles in our index yet.