Medium severity5.3NVD Advisory· Published Nov 6, 2019· Updated Jun 17, 2026

CVE-2019-5643

Description

Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may enumerate the user names and facility names in use on a particular installation.

Affected products

Gatech/Computing For Good\'s Basic Laboratory Information System
cpe:2.3:a:gatech:computing_for_good\'s_basic_laboratory_information_system:*:*:*:*:*:*:*:*
Range: <=3.5
Computing For Good/C4G BLISllm-fuzzy
Range: <=3.5
Computing For Good/Basic Laboratory Information Systemllm-fuzzy2 versions
<=3.5+ 1 more
- (no CPE)range: <=3.5
- (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

blog.rapid7.com/2019/09/10/r7-2019-09-cve-2019-5617-cve-2019-5643-cve-2019-5644-c4g-blis-authentication-and-authorization-vulnerabilities-fixed/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

5.3/ 10

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

Probability of exploitation in the next 30 days.

0.90%

VYPR risk score

Composite of severity, exploitation, and reach.

0.35medium

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-284
Improper Access Control
CWE-306
Missing Authentication for Critical Function

CVE ID

CVE-2019-5643

Credits

TV
This vulnerability was first discovered privately and reported internally by C4G BLIS team member Aditi Shah in December 2018. Jacob Robles of Rapid7 rediscovered and reported these issues in March of 2019 per Rapid7's vulnerability disclosure policy (https://www.rapid7.com/security/disclosure/).
finder